7bc2063adc91ce4e55ee47ba9f648b28a5ffece3dcace7d91ed20e54967b45e6

Analysis

max time kernel
187s
max time network
104s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws.py
Size

410B
MD5

22449aa642bd4b6dad84f71c61baddcb
SHA1

43313c2b09dad20251089e9b6e90eb215933e055
SHA256

416221924056c5f68ba5bf5c173db54366045f651e1fe92fc377602da7b9f774
SHA512

1dd5ff1ba879e4fa1918e4234e4a2bc7b901412b9f0898d8bd601f5cf892e63aa994b22b10e9f0dab77305b861f5c2faeec12880a0a5ebfe23c4bf201cc8f4e2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3052	AcroRd32.exe
3052	AcroRd32.exe
3052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2492	2824	cmd.exe	31
PID 2824 wrote to memory of 2492	2824	cmd.exe	31
PID 2824 wrote to memory of 2492	2824	cmd.exe	31
PID 2492 wrote to memory of 3052	2492	rundll32.exe	32
PID 2492 wrote to memory of 3052	2492	rundll32.exe	32
PID 2492 wrote to memory of 3052	2492	rundll32.exe	32
PID 2492 wrote to memory of 3052	2492	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
803d6317d10de39d5c2a1748c9f2c245

SHA1
b04163b2cc1eafe443ef02144a57edc9ab8a76ef

SHA256
8a90d39b391bbfacc404fb4df7256158cd97695a2e4d9c7bf4ca6f95ddac9c9f

SHA512
a088fa211fcf99c54cff5080865eea79af3d7f2244931e2d674e68f612f14f7ac9171e1c12a65b6192e4688e1eef6a658f9b67ad2c0343e34c338790271f59be

Download Submit