728614c7d2e6ad1b7dcf8d885bd65ea0ecc6c9ce49b7f373e0131278492af36a

Analysis

max time kernel
162s
max time network
85s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.10/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/__init__.cpython-310.pyc
Size

191B
MD5

e01a7d815491bd8d99f9416e8892b010
SHA1

ece2323ef9f08e01c986ed014338b7f517ed7bb9
SHA256

095513ed92b577b3b325c9a352a3039c17ef49c4bb2132a7f4c9d9812a645378
SHA512

d178a9a2800bf3c12b1354b5fdcad1329827edda2002110a77c3c4ba69c16997e5285f1ac81a14a5b25007e959ad94357c711e32255cdd968c9cd080b6e77c6c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2480	2336	cmd.exe	31
PID 2336 wrote to memory of 2480	2336	cmd.exe	31
PID 2336 wrote to memory of 2480	2336	cmd.exe	31
PID 2480 wrote to memory of 2884	2480	rundll32.exe	32
PID 2480 wrote to memory of 2884	2480	rundll32.exe	32
PID 2480 wrote to memory of 2884	2480	rundll32.exe	32
PID 2480 wrote to memory of 2884	2480	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\__init__.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\__init__.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\__init__.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3698459d9b6d9ad23d3c470b485bca85

SHA1
db1fbfcb04261789da263ba7141282577f517b3c

SHA256
bafc13cbfadb52edf62f9bc079824de8b233f41db500c554183bd61d224565cf

SHA512
835029fa39dbfe0c81bf24ae50e304cc0bf5b9ce35cd980d08671ad874440e821bfb32f3f33f93ee1a70743fbdd262b8c6fd5c603c23ec3b05571a002584cc5d

Download Submit