2b6e342cb6ef27de7ca0dda5bbba6b3871643835aea5ba9e77881883f6b0659b

Analysis

max time kernel
110s
max time network
18s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
25/08/2023, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bloxflip.py-main/bloxflip/crash.py
Size

358B
MD5

edf12850dd970c7928620336e9ff5514
SHA1

b66273193ff27cc5056a59c6b9ca0f34e11625f3
SHA256

c85fb1ccdc5e44d473870d5515d0ccbe51d56848d62ab8e238072f1be8923158
SHA512

716097142031ccc577b45231ed47bd99dadd0120a71fc6df0071570078099f5d9d1cb4a129967292129ffe2bbeb506e94366790d834b15b215444954c7a052eb

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1372	1712	cmd.exe	29
PID 1712 wrote to memory of 1372	1712	cmd.exe	29
PID 1712 wrote to memory of 1372	1712	cmd.exe	29
PID 1372 wrote to memory of 2936	1372	rundll32.exe	30
PID 1372 wrote to memory of 2936	1372	rundll32.exe	30
PID 1372 wrote to memory of 2936	1372	rundll32.exe	30
PID 1372 wrote to memory of 2936	1372	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bloxflip.py-main\bloxflip\crash.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bloxflip.py-main\bloxflip\crash.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bloxflip.py-main\bloxflip\crash.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e533d6d48b23b7a42b70c5aca182a36c

SHA1
4140860e10784b465e37686cb4a67df773008c32

SHA256
2e99b2994a3d939619a6f4f7b91c05800a766b7a29ba08c9973fd9a95227f57a

SHA512
dcd5ab3e1c6c55b651e4d01478cc9fb08884090b767c5da55055d2092d9962fbc2310323077f0cc5f4e5c0d15932eab71e1dfd9a391fbbbbac395bc9a1faea25

Download Submit