2a8b0a7dff8a89e0d324bf52c8b0c0c9d25530bdcd1ba0e2dad9839c235915c0

Analysis

max time kernel
283s
max time network
321s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws.py
Size

410B
MD5

22449aa642bd4b6dad84f71c61baddcb
SHA1

43313c2b09dad20251089e9b6e90eb215933e055
SHA256

416221924056c5f68ba5bf5c173db54366045f651e1fe92fc377602da7b9f774
SHA512

1dd5ff1ba879e4fa1918e4234e4a2bc7b901412b9f0898d8bd601f5cf892e63aa994b22b10e9f0dab77305b861f5c2faeec12880a0a5ebfe23c4bf201cc8f4e2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2476	AcroRd32.exe
2476	AcroRd32.exe
2476	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 2940	2716	cmd.exe	29
PID 2716 wrote to memory of 2940	2716	cmd.exe	29
PID 2716 wrote to memory of 2940	2716	cmd.exe	29
PID 2940 wrote to memory of 2476	2940	rundll32.exe	30
PID 2940 wrote to memory of 2476	2940	rundll32.exe	30
PID 2940 wrote to memory of 2476	2940	rundll32.exe	30
PID 2940 wrote to memory of 2476	2940	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a7617a94c75e5a2c19826a541c27e71a

SHA1
d85e52bf09e300ec63279a9afe7a8d91d93da4c4

SHA256
6c46a340576c4163d5ced331f931fed8ab75658041daac563151fabe5e87ad0c

SHA512
99188ced018128de3b4b8511cd637d429407fda64d55ed5a3b63f0edb6f1b0aa00f66cbc61a6ca2581139a450e400390981901f7b4ef2fb8095f90071ea6d14d

Download Submit