64775fe26aa88c7cf6048b83a804009de2514bbb2cc9783ecd3d079b64ebbb8e

Analysis

max time kernel
157s
max time network
47s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/ec2.py
Size

1KB
MD5

06db63f595495501deca7a491c64c31c
SHA1

461d4b6e1e167f276a393e97b9c4bda0fe25fa03
SHA256

491b912fd5be6d4664cfb736716fb26b41a364fb6fd031b6aa388c91367af47e
SHA512

2b26857ddb254deb6908713d129e9d5aff6128c5c78ba184aa293dc38e58c596ebbbf33962580e7a18bbf508eab7ee2fd9a57d6766b46cac9cda7c995aefb5f2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1048	AcroRd32.exe
1048	AcroRd32.exe
1048	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2600	2584	cmd.exe	31
PID 2584 wrote to memory of 2600	2584	cmd.exe	31
PID 2584 wrote to memory of 2600	2584	cmd.exe	31
PID 2600 wrote to memory of 1048	2600	rundll32.exe	32
PID 2600 wrote to memory of 1048	2600	rundll32.exe	32
PID 2600 wrote to memory of 1048	2600	rundll32.exe	32
PID 2600 wrote to memory of 1048	2600	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\ec2.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\ec2.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\ec2.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
23564365cda295442f2f2fd9923e7a2f

SHA1
8af3372382585741824bae9f6404735dbc5f04fd

SHA256
20ce8f8289ba28bcd6cd7e75d60d12654b2287adc0c1d195a9e2b02da903d64d

SHA512
d3f56f7b8d5a4da0e9c2713e078ef45aec9e2697070991a3afcac0b823dfa384799d62850962f9b92aededbd02376360deb6957ddec6d35e3250d89735a25117

Download Submit