ec2e340b5acb84a94171cf79b5348c9b7456f8fea3dff08ab64ecd068fc06d23

Analysis

max time kernel
188s
max time network
110s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/__pycache__/ansible_release.cpython-311.pyc
Size

207B
MD5

c50926be6fe5031313ab29df511ab869
SHA1

8d68d0cc299276209ed5168c7b9bf2b956306d03
SHA256

466f8b32453dc74b6aa5c9a482e7b65c0031256fe1b912aff32c9e2587c9a693
SHA512

75fc55310a74187a07092ced247df4da6dd41eb03f9c288a226ff220bd72720f79abc0189cf132bbbdb6b26c836963760aeed89f7165d88dd3e5a9b54bd934da

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1416	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1416	AcroRd32.exe
1416	AcroRd32.exe
1416	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2656	2676	cmd.exe	30
PID 2676 wrote to memory of 2656	2676	cmd.exe	30
PID 2676 wrote to memory of 2656	2676	cmd.exe	30
PID 2656 wrote to memory of 1416	2656	rundll32.exe	32
PID 2656 wrote to memory of 1416	2656	rundll32.exe	32
PID 2656 wrote to memory of 1416	2656	rundll32.exe	32
PID 2656 wrote to memory of 1416	2656	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\__pycache__\ansible_release.cpython-311.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\__pycache__\ansible_release.cpython-311.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\__pycache__\ansible_release.cpython-311.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
03e028e11db4b698c350f522d9e6f006

SHA1
ef96acb98178a0bfd15b17d1f8ba8b944b051977

SHA256
b3c91ceb791abedd2aaf4ed73303c7fcbe40e36899ac221cefc49c0130805f46

SHA512
5923524a455fe9f0208c4dfa089d9d5914386d0fd8e4a6cdff6042dc5acaa49ca952fffc0042b0008583623f4b5778b1b93abe7e8642d0d85c60ee53d21ee49f

Download Submit