ec2e340b5acb84a94171cf79b5348c9b7456f8fea3dff08ab64ecd068fc06d23

Analysis

max time kernel
169s
max time network
141s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/boto3.cpython-311.pyc
Size

718B
MD5

447305548bcff1fc92d3c832cc2840c9
SHA1

6316ae7b47b6d4598c542a9c12e09e8c52b12faf
SHA256

df45ce1a1752b3b5bef32886367a19dd43a8dd6a16357280116bdc9d57dc464e
SHA512

ef0242be6c5492b1df2e46d2259ec4291f2dc9ae9cffa320ac6c497a10141307349cd37cdebc52b3f87603502e7c6fd400f0fddd3f5fcbb1c2d7c9aa12392987

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3044	AcroRd32.exe
3044	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 2724	2608	cmd.exe	29
PID 2608 wrote to memory of 2724	2608	cmd.exe	29
PID 2608 wrote to memory of 2724	2608	cmd.exe	29
PID 2724 wrote to memory of 3044	2724	rundll32.exe	30
PID 2724 wrote to memory of 3044	2724	rundll32.exe	30
PID 2724 wrote to memory of 3044	2724	rundll32.exe	30
PID 2724 wrote to memory of 3044	2724	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\boto3.cpython-311.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
07878785c9cc4215cd1f9a87e9d53bc3

SHA1
f99a94a2d4fef8d11d00b9e9679a446d785ddf58

SHA256
f29b9087d8035d06a256edcef8da8f2108477260acb591e1c7b78a7b1b63a083

SHA512
d08fa6f5b33f2aeb6408118f826a4e2e2beb54d784028edf5472f9158c948c2913ff3f29493686abedecd299e39f1f589d567d07429eb55166f7b4a5d7c918bd

Download Submit