a034bcb0be853973913fda53f4c3ce71f38e450c865d718af086f360e22af318

Analysis

max time kernel
208s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bennu-0.4.1a7/bennu/__init__.py
Size

196B
MD5

b1ad7b35ce77878b79293f7c751d625b
SHA1

acae9f738cf6f5bc89229b9c3277de7bc310103f
SHA256

ce155d86983088d5f32d360c3dd4489a1f8261d263b4405601a15758a0aaa766
SHA512

ab3ca840f1a9fae54784a6cbe8587c6c6e55a50eb2c763e898f4b8fb5bf1f2573c18ef34a07ab277bb2f309802930d04c1f674a9ddade43a6bf100df2ac695ff

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3060	AcroRd32.exe
3060	AcroRd32.exe
3060	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 2436	1980	cmd.exe	29
PID 1980 wrote to memory of 2436	1980	cmd.exe	29
PID 1980 wrote to memory of 2436	1980	cmd.exe	29
PID 2436 wrote to memory of 3060	2436	rundll32.exe	30
PID 2436 wrote to memory of 3060	2436	rundll32.exe	30
PID 2436 wrote to memory of 3060	2436	rundll32.exe	30
PID 2436 wrote to memory of 3060	2436	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\__init__.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\__init__.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\__init__.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b782716b5d2d3079ac804591c0ee9bd8

SHA1
cf3ff610419665b50a8499366905e9382666ce98

SHA256
b766bb5d0205e5dd1c2e48acf1caa03863f31259b8851ec881f7b5232c76718b

SHA512
c0f390683a4f873b9c815480bef1aff91a04ca3881fa51584b51a83d2fe38a9d8b1811dc0239b37f3b7b289881ca641fbb86d0b579811732f6ba962bf311c41b

Download Submit