f468da34285c74eee812a02dac1fa5b22d84d5b3535a31618d33c644249e1c5d

Analysis

max time kernel
151s
max time network
120s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
14-08-2023 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoulsOufitManager.pyc
Size

19KB
MD5

807080c007360922a38de9babb87a76f
SHA1

8e517a630a2f4d0190acfd8e8a15343d41b0a988
SHA256

67d84ac77796693e94605bdd5be6e997a61a18f0884810fe5b43fae5ad59e02e
SHA512

40def03434382bc1f23a28bfe966d6c215c0b7ee5eef813e31b4f752f16102aff7e6212d3e485f6cfc3ba6de7da346dede63a9d0770def50d602c1c45c555109
SSDEEP

384:FVOM178QvvpnHwJFsLAszlYoDYVmVrb1zQJIj6V0SBCXYqZFCjYr68KKz:FkM17h2JFIaVirb1Yy6GfIqZEP8KKz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\pyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe
2676	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2668	2320	cmd.exe	29
PID 2320 wrote to memory of 2668	2320	cmd.exe	29
PID 2320 wrote to memory of 2668	2320	cmd.exe	29
PID 2668 wrote to memory of 2676	2668	rundll32.exe	32
PID 2668 wrote to memory of 2676	2668	rundll32.exe	32
PID 2668 wrote to memory of 2676	2668	rundll32.exe	32
PID 2668 wrote to memory of 2676	2668	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SoulsOufitManager.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SoulsOufitManager.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SoulsOufitManager.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
da377420e13093a917a94a51892f7dfc

SHA1
87ae22fabc6ed6ddd07d52c455e5e3eb87bfff40

SHA256
31f93445e523a226f72d13ac8fb64802590c45d34e5a2fd4f2f2c9c246a8ed5c

SHA512
61f97eee65142e04517994ffde5e794c35950c4a4a65d61139c2a69eda08cf50c9744fa4659c671bc9ab71911d3d718eae37f35fb8f39a98ed1062aa54b9637f

Download Submit