e65c027b71cb87a07ebbb30fa0919090580cd1ae984418b55665fbeeb94afcd3

Analysis

max time kernel
153s
max time network
127s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
27/08/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/python2.7/future/backports/test/support.pyo
Size

59KB
MD5

4d4c48f8b655588b63697c3df3ab25f7
SHA1

4ddc1bc3ff37af4a5ee7e04f504b909efc0e27b8
SHA256

782b29d3dc3c9c984c9fb8524f2c74be0bb76b415f5127b393494793a2c857b4
SHA512

dcc4400be8a08c26fc76638b2b50feafb26db81178a005670d214229701d6f257b7819679dfb1c506e0be2bb0ab47aa5f31fe2c11534a416b4d49dc339ae6d38
SSDEEP

1536:BdGwlYUOebeCs6T0oVSe98yjCenzdLgMZDvKP9xC0SCpZLzB74C/7L04YQMa6tXH:B8wlYUOe5se0oVSe98yjCenzdLgiDvaA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.pyo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-722410544-1258951091-1992882075-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1512	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1512	AcroRd32.exe
1512	AcroRd32.exe
1512	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2288	2444	cmd.exe	29
PID 2444 wrote to memory of 2288	2444	cmd.exe	29
PID 2444 wrote to memory of 2288	2444	cmd.exe	29
PID 2288 wrote to memory of 1512	2288	rundll32.exe	30
PID 2288 wrote to memory of 1512	2288	rundll32.exe	30
PID 2288 wrote to memory of 1512	2288	rundll32.exe	30
PID 2288 wrote to memory of 1512	2288	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\python2.7\future\backports\test\support.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lib\python2.7\future\backports\test\support.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lib\python2.7\future\backports\test\support.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
47efad5b7ca037d8c949884046b64510

SHA1
a31d3bb4b500c8a903a999a49f5d18f2f8ceb3d6

SHA256
48bd4e7f0fce63918bee43a24c80a2ba28357bb6211dbfdeb748184dd740183c

SHA512
59f8560805242b1ce67944e1c386ff692399c01a02a614fe37d3954c3590f8c47a851db45a2ab89b932aaa43ffca7bebf693f65a5c6109cea961efa3d6ad99a5

Download Submit