Analysis

  • max time kernel
    213s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    07/10/2023, 23:54

General

  • Target

    usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/callback/__pycache__/aws_res.pyc

  • Size

    4KB

  • MD5

    48ef18ad7546bf44ad8ce6416834e719

  • SHA1

    afe8f83ffff3a3142e6c72e328b6e06f43ab602a

  • SHA256

    cbf633135e2624230852bc6ca1097da224062c5b27b6d61caf295d7951dffc25

  • SHA512

    343666b48f48426bdb836bd589d098a98a3b433483f5566c5dd2eb3df51f013b5c4fab93b7d282645f71dff6f754a404dbc2a893d60e2395994e47f4839d44a0

  • SSDEEP

    96:wWTnJjVHxZ8Mpwq+3JTt9Ff/kCqlkgs/P5e06D6NC:wu5RaMp+3ZhQlkW06D6A

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\__pycache__\aws_res.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2908
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\__pycache__\aws_res.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3012
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\callback\__pycache__\aws_res.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2568

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    484e5b3b02324b0a1c5cd75372619864

    SHA1

    670f2384fe46c01ce73af1f522d03f7d2992771d

    SHA256

    d9c254b641077cc6b5c5a3bd2db5fc2f6502ed6a34e1084b577bdec193e714bc

    SHA512

    402f108a3fe545ee81666b9474bbeff05d97b4c410a8471af8158aa873bac94f24376b7a6841c3ae1e9722145ee2454b017dfede4b0924241db873edfddfca1e