Overview
overview
3Static
static
3TaxHeaven3...em.pyc
windows10-2004-x64
3TaxHeaven3...re.pyc
windows10-2004-x64
3TaxHeaven3...gi.pyc
windows10-2004-x64
3TaxHeaven3...__.pyc
windows10-2004-x64
3TaxHeaven3...eq.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...on.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...__.pyc
windows10-2004-x64
3TaxHeaven3...ct.pyc
windows10-2004-x64
3TaxHeaven3...ne.pyc
windows10-2004-x64
3TaxHeaven3...at.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...ms.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...sm.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...eq.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...eq.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...eq.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...er.pyc
windows10-2004-x64
3TaxHeaven3...eq.pyc
windows10-2004-x64
3TaxHeaven3...tx.pyc
windows10-2004-x64
3TaxHeaven3...el.pyc
windows10-2004-x64
3TaxHeaven3...el.pyc
windows10-2004-x64
3TaxHeaven3...el.pyc
windows10-2004-x64
3TaxHeaven3...el.pyc
windows10-2004-x64
3TaxHeaven3...el.pyc
windows10-2004-x64
3Analysis
-
max time kernel
102s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18-08-2023 23:34
Static task
static1
Behavioral task
behavioral1
Sample
TaxHeaven3000-1.0-win/lib/python3.9/certifi/cacert.pem.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral2
Sample
TaxHeaven3000-1.0-win/lib/python3.9/certifi/core.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral3
Sample
TaxHeaven3000-1.0-win/lib/python3.9/cgi.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/__init__.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral5
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/big5freq.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/big5prober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral7
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/chardistribution.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/charsetgroupprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral9
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/charsetprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/cli/__init__.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral11
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/cli/chardetect.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/codingstatemachine.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral13
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/compat.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/cp949prober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral15
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/enums.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/escprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral17
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/escsm.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/eucjpprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral19
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/euckrfreq.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/euckrprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral21
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/euctwfreq.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/euctwprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral23
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/gb2312freq.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/gb2312prober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral25
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/hebrewprober.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/jisfreq.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral27
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/jpcntx.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langbulgarianmodel.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral29
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langcyrillicmodel.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langgreekmodel.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral31
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langhebrewmodel.pyc
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langhungarianmodel.pyc
Resource
win10v2004-20230703-en
General
-
Target
TaxHeaven3000-1.0-win/lib/python3.9/chardet/langcyrillicmodel.pyc
-
Size
28KB
-
MD5
86d2b520869c04fc50305c8c7f2b6970
-
SHA1
9e430b6b349b642cbe3e41535b16618ad69ff9dc
-
SHA256
08e7fe901247bb80cd4b3ba755fdda2a948397ad5c3ab54cc34c609f44db7078
-
SHA512
d91cb2d7efb4a7e8798a4e958e2906464083ee1cadfc3d93b61259ac393c4fb8f3102d4bb1bf766ea20660a3c8f5818f14275374dc4370f64d67c9de3795943d
-
SSDEEP
96:Wu5leX5DB/bB199i9maM299i9lyaF99Q9ma1P99wta1TH0997G9wadLbFZJB9rlK:WIlqBX9wx59wzF9OxB9OITH09ELLCSM
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3740 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\TaxHeaven3000-1.0-win\lib\python3.9\chardet\langcyrillicmodel.pyc1⤵
- Modifies registry class
PID:3856
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3740