c38ee06477431c2624e80b916da07057258b85ef9f3300e5d2510256b72dd45f

Analysis

max time kernel
268s
max time network
323s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.11/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/aws.py
Size

7KB
MD5

f2b5ff41a73e1b6992816a616d638b2b
SHA1

f70bec12662c579bcc2e1634e2e2a1af149bb674
SHA256

5caf40df1026e68f17a9f9618e7a52a3da812be19d6d45f195210ff62e466f6b
SHA512

05cf6a3d117febb9e15c4730065bbc378fe22f8ffa09e2d6199b359b4041767bdbf68d1c2b10cf4233f7c799895aceb38e288db69f6ca0426755bc5947af61b0
SSDEEP

96:wCK+ooDLO1X9+tgZBoApAK+ABcepfvzUyVqlOBG5N0/0aaz3DLZKzXzxZ:wCKoO1X9NAK/dyOBAai3DEzXzxZ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
748	AcroRd32.exe
748	AcroRd32.exe
748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 2728	2592	cmd.exe	28
PID 2592 wrote to memory of 2728	2592	cmd.exe	28
PID 2592 wrote to memory of 2728	2592	cmd.exe	28
PID 2728 wrote to memory of 748	2728	rundll32.exe	29
PID 2728 wrote to memory of 748	2728	rundll32.exe	29
PID 2728 wrote to memory of 748	2728	rundll32.exe	29
PID 2728 wrote to memory of 748	2728	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.11\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\aws.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ec5ec58efbbb58bf5f9e91edec322d3f

SHA1
f2781274b1e9e966da247a1ee23e03c61bda2722

SHA256
19bc86709fb776c549a685c674dcf77ee0009acdd062081dd8e69a078744e9e0

SHA512
bba63a93bd851ff096e66089a7aaa33b93152b100be368cfb2a090ed8df3bc4cbcf315e58a57887d6c7ccdbbacc17b7432bc2046aba4c4618761346a0ac7b421

Download Submit