ec2e340b5acb84a94171cf79b5348c9b7456f8fea3dff08ab64ecd068fc06d23

Analysis

max time kernel
408s
max time network
390s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/lookup/__pycache__/aws_service_ip_ranges.cpython-311.pyc
Size

5KB
MD5

771914cd1e315225124f7643cb5388f7
SHA1

6e4bb5906f3a1fb7cb8cd0f416566d4eb3990409
SHA256

ab272175c32b2be3958c82e6acfc5f07ebed1d39de20f2b078587bf3caf2e12c
SHA512

b4173d733e7644af807ee080ebeaf5c1d9b0dc024d12f273647e80de850345e869f77a4e9eca1fddfe94d627b87e7390b82482a05837abc52993d1f4ab2f4fe1
SSDEEP

96:rH6EV0HzFHfIfWP+JDaEOm359C2iueC/5nzbthpNIlXH3n7rHH4gOOOe+VOllsl2:Z0HVqRDz359peC/5lhjEXL8gOOOpVOlf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1272	AcroRd32.exe
1272	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2892	2500	cmd.exe	28
PID 2500 wrote to memory of 2892	2500	cmd.exe	28
PID 2500 wrote to memory of 2892	2500	cmd.exe	28
PID 2892 wrote to memory of 1272	2892	rundll32.exe	29
PID 2892 wrote to memory of 1272	2892	rundll32.exe	29
PID 2892 wrote to memory of 1272	2892	rundll32.exe	29
PID 2892 wrote to memory of 1272	2892	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\lookup\__pycache__\aws_service_ip_ranges.cpython-311.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\lookup\__pycache__\aws_service_ip_ranges.cpython-311.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\lookup\__pycache__\aws_service_ip_ranges.cpython-311.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ec8d3bc47535c66c6580bd147ac6fe07

SHA1
0c5e6a18bfd76bb0b4374b2095ff0eb22a873039

SHA256
bbf3a4d3f0375f4a5157876d4f7411fc156e1f62aba2f332f3b34551d406710e

SHA512
509df1cf6f615055ab738ebf90c7ce108eb8af43d94e606a789b0a6e38022cc1376205e85e8b97edb054905c945e8235b1db4eb253edd5fdef256efb4fe23b60

Download Submit