42d3445f936aa637139d15f6a2238a5d53b145d5938255daad1b81fd2a1aa153

Analysis

max time kernel
157s
max time network
136s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-09-2023 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Hornynite-0.14-win/lib/python3.9/__future__.pyc
Size

4KB
MD5

7601462b5b8ac8253d3df7e376b70497
SHA1

2c4972450b267ecda76b715df90025b97fec656a
SHA256

503225472b86ea58bea49743fe2a9a9ca3996c44a6adf41866c0f86a2f859344
SHA512

2d3c8c05b8e54f25dc779249f031e2ca2ecd0137dd1f8aa444f4bc8bf43fff248ce50c316c91e81ac8bb88bc5c173083e0f059a914112ccaa0d87adf28f8bfc0
SSDEEP

96:hg1NzUuGd+P2sKNwWKD2j82xnCg8Q/Ks/qN+Bj0ui:k4BRdKD1YCM/KsSN+Bj0ui

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2536	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2536	AcroRd32.exe
2536	AcroRd32.exe
2536	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2712	2700	cmd.exe	29
PID 2700 wrote to memory of 2712	2700	cmd.exe	29
PID 2700 wrote to memory of 2712	2700	cmd.exe	29
PID 2712 wrote to memory of 2536	2712	rundll32.exe	30
PID 2712 wrote to memory of 2536	2712	rundll32.exe	30
PID 2712 wrote to memory of 2536	2712	rundll32.exe	30
PID 2712 wrote to memory of 2536	2712	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Hornynite-0.14-win\lib\python3.9\__future__.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Hornynite-0.14-win\lib\python3.9\__future__.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Hornynite-0.14-win\lib\python3.9\__future__.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e2fd1d0cb0523fb0718942ea1dc707d

SHA1
c7de4a1c67a8909f55888ef9f0c1ea79fdba8eac

SHA256
a62af8fe98394cdc51fc05b7b248ab3dbdf82c04bd7b3259d82cccf0d161d909

SHA512
73c298f99fc86f49853adf96b116ecbaa29bc8cd0371fedcada2bd6c7722fe2ee4888bf40d80508e5bf64ef1a7d1711dffe0a5fe1cd88656e09e6cb7c17090fd

Download Submit