ce7594889d9a034fa68a867b981138e90cb7535722c4d66a1a432b0e7e408ecd

Analysis

max time kernel
422s
max time network
621s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 23:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/aws.cpython-311.pyc
Size

718B
MD5

b467d10904cda78bcbd02b8cb33ca45f
SHA1

a675ee4dca090fc63f098fc1f7a79a55cbe337fb
SHA256

57738b990e330cdbabf17593b8cade0ed56728f5a2bbd598f7802201a8f2d366
SHA512

f014a399bbd26cc553be842d58a39d1f1df343154c5e4a5b305176a2679165b838157c7feb90ec145c46aa682639422251098513a6a18abf3a86baaeca03ca96

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
364	AcroRd32.exe
364	AcroRd32.exe
364	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2988	3028	cmd.exe	27
PID 3028 wrote to memory of 2988	3028	cmd.exe	27
PID 3028 wrote to memory of 2988	3028	cmd.exe	27
PID 2988 wrote to memory of 364	2988	rundll32.exe	28
PID 2988 wrote to memory of 364	2988	rundll32.exe	28
PID 2988 wrote to memory of 364	2988	rundll32.exe	28
PID 2988 wrote to memory of 364	2988	rundll32.exe	28

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aws.cpython-311.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aws.cpython-311.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aws.cpython-311.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d7c17633e074510b0eb4b6a036db7d88

SHA1
cd9937828e5e08b13017c33ae0503092a50d3c5d

SHA256
770fb86cb61ab6f121fb390bc4813b0c47208cda7ab0a0d40bbcbeba743e21f1

SHA512
6eac4193cee857038c79d18027ad435c4aa0e18e14326e5ca4f4936120cfd235dd447c0988dd52666f8b5285aed4d1df8a4f7ae950a6dbf8cb80bf461775ccff

Download Submit