7bc2063adc91ce4e55ee47ba9f648b28a5ffece3dcace7d91ed20e54967b45e6

Analysis

max time kernel
183s
max time network
194s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/callback/aws_resource_actions.py
Size

2KB
MD5

00f2c84682240158b0a60f6d6ed0f961
SHA1

d9d31487ddb553b0061aa99e913311e4c61da5bb
SHA256

5162728d0be3329cad8b8252bb505709235a8b61ac4f27a726891db38d02f7ac
SHA512

9ae5ace7cf928b57c56f00e727ad7f3de967999562c303ded30acccae3aed3d2b3fb31bce7f4a0429b4c20cb13445b7d6eca6364be0aae9b95ff5517ecf7a878

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	AcroRd32.exe
3028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2536	2712	cmd.exe	28
PID 2712 wrote to memory of 2536	2712	cmd.exe	28
PID 2712 wrote to memory of 2536	2712	cmd.exe	28
PID 2536 wrote to memory of 3028	2536	rundll32.exe	29
PID 2536 wrote to memory of 3028	2536	rundll32.exe	29
PID 2536 wrote to memory of 3028	2536	rundll32.exe	29
PID 2536 wrote to memory of 3028	2536	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\aws_resource_actions.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\aws_resource_actions.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\aws_resource_actions.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d597d6b7ab2c20c93dc87bc2261766ef

SHA1
427e3617976e57af88cb08820c2624ba1d854e02

SHA256
d2050723d5c62ab609911e2a610a5e37424ed39e5e0d8763fbf458988c958f58

SHA512
87044d9a24a42e25a99c61bf175c31feaab6b50e4c5e0f01f29fc474f966321c4a20fcc2b5bbb69db5a28b3f9a103f33c3faa2e826ca47e144e45e8ce0bf3cca

Download Submit