7bc2063adc91ce4e55ee47ba9f648b28a5ffece3dcace7d91ed20e54967b45e6

Analysis

max time kernel
308s
max time network
322s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws_credentials.py
Size

2KB
MD5

be3fe6e0a415dd42723909538443cd2c
SHA1

6604944d072b534aac617d800ec2a0b4130f1517
SHA256

7859a32aa9aa5ba188363e26ab9579e4384b8268f70a3893beb8ea437c3fe548
SHA512

fc78af4dfef4d4b65a41b11469144e09391dcb1946de55afbb26ed0e5bc844bd176e4eab649a2578241996a6bfdedef336bff08eb21c3749e8977ab34e60f749

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1644	AcroRd32.exe
1644	AcroRd32.exe
1644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2528	2848	cmd.exe	29
PID 2848 wrote to memory of 2528	2848	cmd.exe	29
PID 2848 wrote to memory of 2528	2848	cmd.exe	29
PID 2528 wrote to memory of 1644	2528	rundll32.exe	31
PID 2528 wrote to memory of 1644	2528	rundll32.exe	31
PID 2528 wrote to memory of 1644	2528	rundll32.exe	31
PID 2528 wrote to memory of 1644	2528	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_credentials.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_credentials.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws_credentials.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
77c44fddeb91a4dfda73ec2ef036bf38

SHA1
8abb2a0f2c483bc72a4fb7805dc732278eddcf0d

SHA256
9bc5b3c95f858f0174f099a10ef8f0ed5575e8c9d9dcdf39ef67d56a8eea09d3

SHA512
9c950b223ecf5746dbcd8876a8172bd6018d4f5be245e96f33fd862f4c4f7498f5a1cf78acb68a4f97149e131a1fb7611eca65fca58d90908c174c6ebef618b2

Download Submit