bbf75a83252755cb25b12526d295e25556751f8fcf7fc6209d93312a71b4d9c2

Analysis

max time kernel
56s
max time network
20s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
31/08/2023, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v3/mohoe.py
Size

40KB
MD5

3b6624afda561c10c979d2346780a8fc
SHA1

87760149075732e66cb9ea5d0cf215a230b2622a
SHA256

322975c28e3abfe66fe5cfb71841c027b649bff3da938ce3b687fc06ea9a71ff
SHA512

234557d6133d54b5f079356902ba3ca1741a9f39d07af5b923751e160460f5cc7a928a82be52ba13d6d308ceb934de7c63df8fa0bb09d1590a0f3d54cd1f912e
SSDEEP

384:zcCUNZ5HargTED6WtpggASQNBdA3GoNZIZKWloK/fUm2ryU1IqYxVlQ35lJZ8kjJ:z5tpDyKyS5p7sQRyy7z6WCVL+d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3032	AcroRd32.exe
3032	AcroRd32.exe
3032	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2852	3068	cmd.exe	29
PID 3068 wrote to memory of 2852	3068	cmd.exe	29
PID 3068 wrote to memory of 2852	3068	cmd.exe	29
PID 2852 wrote to memory of 3032	2852	rundll32.exe	30
PID 2852 wrote to memory of 3032	2852	rundll32.exe	30
PID 2852 wrote to memory of 3032	2852	rundll32.exe	30
PID 2852 wrote to memory of 3032	2852	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v3\mohoe.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\v3\mohoe.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\v3\mohoe.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
68f3f700070fb7fe0ed1294dc5ead9a8

SHA1
479424f74c19ae48a71bf53c63282370bd9cfe01

SHA256
41b784d76f4367b5145b489cc7412bbeaf3d4a4dfd6ba3a28afaf5b9e132d6a4

SHA512
b11e6e39d487ef831549d5d31d921906dbc37c142f124f29e22823301574defa2514938df030fb8a8667a5a241387742676673899acca9f915472da8fabee295

Download Submit