728614c7d2e6ad1b7dcf8d885bd65ea0ecc6c9ce49b7f373e0131278492af36a

Analysis

max time kernel
176s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08-10-2023 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

usr/lib/python3.10/site-packages/ansible_collections/amazon/aws/plugins/doc_fragments/__pycache__/aw.pyc
Size

1KB
MD5

05bbf68356de5b41b9f49674710c9e33
SHA1

11375d44816bda84a9831fda05e04fbdbbde15f3
SHA256

bb5c0807915017b328356a0e4ec0ae811ef5b66b81cb1371c554e4e311ba141c
SHA512

1bf7eeda2472b4edf787105f2280a00af894f60d2b38baf46cb3b21979e8ed5ffe4c978514134c523e4df5999260ffb0cce9f912b0b85e6a733bec3624ef5d09

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2476	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2476	AcroRd32.exe
2476	AcroRd32.exe
2476	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2756	2648	cmd.exe	30
PID 2648 wrote to memory of 2756	2648	cmd.exe	30
PID 2648 wrote to memory of 2756	2648	cmd.exe	30
PID 2756 wrote to memory of 2476	2756	rundll32.exe	32
PID 2756 wrote to memory of 2476	2756	rundll32.exe	32
PID 2756 wrote to memory of 2476	2756	rundll32.exe	32
PID 2756 wrote to memory of 2476	2756	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\usr\lib\python3.10\site-packages\ansible_collections\amazon\aws\plugins\doc_fragments\__pycache__\aw.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
589d162b4688cc9a24cd2fea2cbaf319

SHA1
880bf80d84640d7cfb7f7258e00da65270390715

SHA256
c243902ed3ceb278d0f62bfcfe6e9c86c49781607979c9932d3685d8405622ad

SHA512
56d1afa64a908bc423737f446aa5a5b05f74ac7daf5cb84cce6101c12e11537fe041f633ec578e9376a0e3299a38db382c2a52588033bf0580fa06985c89b3fc

Download Submit