64775fe26aa88c7cf6048b83a804009de2514bbb2cc9783ecd3d079b64ebbb8e

Analysis

max time kernel
288s
max time network
320s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws.py
Size

7KB
MD5

f2b5ff41a73e1b6992816a616d638b2b
SHA1

f70bec12662c579bcc2e1634e2e2a1af149bb674
SHA256

5caf40df1026e68f17a9f9618e7a52a3da812be19d6d45f195210ff62e466f6b
SHA512

05cf6a3d117febb9e15c4730065bbc378fe22f8ffa09e2d6199b359b4041767bdbf68d1c2b10cf4233f7c799895aceb38e288db69f6ca0426755bc5947af61b0
SSDEEP

96:wCK+ooDLO1X9+tgZBoApAK+ABcepfvzUyVqlOBG5N0/0aaz3DLZKzXzxZ:wCKoO1X9NAK/dyOBAai3DEzXzxZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2492	AcroRd32.exe
2492	AcroRd32.exe
2492	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2824	2636	cmd.exe	28
PID 2636 wrote to memory of 2824	2636	cmd.exe	28
PID 2636 wrote to memory of 2824	2636	cmd.exe	28
PID 2824 wrote to memory of 2492	2824	rundll32.exe	29
PID 2824 wrote to memory of 2492	2824	rundll32.exe	29
PID 2824 wrote to memory of 2492	2824	rundll32.exe	29
PID 2824 wrote to memory of 2492	2824	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2dcbd9505060ceed9130b270a078bde3

SHA1
ef28bdcc61d7205d94a736b55d9dfd0f9641ac8e

SHA256
297636b5046bb4b1fdba35b7c6e99818a8d357918ef3d1cd86833b2614042a3a

SHA512
8cd92f68880c132ce8c4931a8b6a0cd486c0952bb75b2c0cf9e314d111ebea15da32850b555524ef12a6e2401cf8386f96842928ac99ffd863f210dfe9a5ad22

Download Submit