10ee2f68a96f92fdc8de553920af561bed367fea458cb91c284cabc9ae03d216

Analysis

max time kernel
145s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2023 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TaxHeaven3000-1.0-win/lib/python3.9/certifi/cacert.pem.pyc
Size

259KB
MD5

ea4ee2af66c4c57b8a275867e9dc07cd
SHA1

d904976736e6db3c69c304e96172234078242331
SHA256

fa883829ebb8cd2a602f9b21c1f85de24cf47949d520bceb1828b4cd1cb6906c
SHA512

4114105f63e72b54e506d06168b102a9130263576200fb21532140c0e9936149259879ac30a8b78f15ae7cb0b59b043db5154091312da731ac16e67e6314c412
SSDEEP

6144:fW1H7M8f9Z0mNplX4XCRrcMFADwYCuMsligT/Q5MS/:fWN7vZLNLqCRrctb65Mi

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.pyc	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\pyc_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\pyc_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\pyc_auto_file\shell\Read\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Local Settings	cmd.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\.pyc\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Ref	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\Ref\ = "pyc_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3195054982-4292022746-1467505928-1000_Classes\pyc_auto_file\shell\Read	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3408	OpenWith.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3408	OpenWith.exe
3640	AcroRd32.exe
3640	AcroRd32.exe
3640	AcroRd32.exe
3640	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3408 wrote to memory of 3640	3408	OpenWith.exe	93
PID 3408 wrote to memory of 3640	3408	OpenWith.exe	93
PID 3408 wrote to memory of 3640	3408	OpenWith.exe	93
PID 3640 wrote to memory of 3756	3640	AcroRd32.exe	96
PID 3640 wrote to memory of 3756	3640	AcroRd32.exe	96
PID 3640 wrote to memory of 3756	3640	AcroRd32.exe	96
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 1876	3756	RdrCEF.exe	97
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98
PID 3756 wrote to memory of 2780	3756	RdrCEF.exe	98

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TaxHeaven3000-1.0-win\lib\python3.9\certifi\cacert.pem.pyc
1⤵
- Modifies registry class
PID:2776

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3408
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TaxHeaven3000-1.0-win\lib\python3.9\certifi\cacert.pem.pyc"
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3640
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3756
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9111D35ACEA765C67E3DFF4B0331534E --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3FD251311BA693DFB0E515BE75750BED --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3FD251311BA693DFB0E515BE75750BED --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2780
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=944DAB96246BEC3DDBB726943387A948 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5FAE9214DCD102107F6BF36E534B57EE --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F4E4CCEAEAB4412B4D57B458362DE759 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
b166aeaa73fe9a8f63541a310b45a977

SHA1
621caa9ca629808450c0cb2f57f491cfeadd4288

SHA256
7ff98d3266376d576800954c165e43d9cc4d430b856bf13215c0f98fef792ac4

SHA512
2e3d1c62a8b57192bb44e04fed680a1155812d6939628541f44de5bfd1c0392af2d7a55c8112140e3911a9dfc40d30ae1f86360ca657bd3ade455b5be45b6c5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
25c3e067929c16be69d97fbfc13be043

SHA1
71a7445a3da85d15328f089081bc20ada73de917

SHA256
f57631af3d86117f66ff4dd2ac4c425e47d510fb91ef24943c66a387daa4a814

SHA512
3bfeb2ff38ba3bb292325cb2c1ddc1f105553cdabe053f2c9120b8e7dcffce9bafc54649084606c4d31c508f5ea00e6f899ae43ca48e9c53e442ea26733a0062

Download Submit