a034bcb0be853973913fda53f4c3ce71f38e450c865d718af086f360e22af318

Analysis

max time kernel
207s
max time network
111s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
08/10/2023, 01:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bennu-0.4.1a7/bennu/mod/__init__.py
Size

196B
MD5

b1ad7b35ce77878b79293f7c751d625b
SHA1

acae9f738cf6f5bc89229b9c3277de7bc310103f
SHA256

ce155d86983088d5f32d360c3dd4489a1f8261d263b4405601a15758a0aaa766
SHA512

ab3ca840f1a9fae54784a6cbe8587c6c6e55a50eb2c763e898f4b8fb5bf1f2573c18ef34a07ab277bb2f309802930d04c1f674a9ddade43a6bf100df2ac695ff

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2728	3028	cmd.exe	28
PID 3028 wrote to memory of 2728	3028	cmd.exe	28
PID 3028 wrote to memory of 2728	3028	cmd.exe	28
PID 2728 wrote to memory of 2772	2728	rundll32.exe	29
PID 2728 wrote to memory of 2772	2728	rundll32.exe	29
PID 2728 wrote to memory of 2772	2728	rundll32.exe	29
PID 2728 wrote to memory of 2772	2728	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\mod\__init__.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\mod\__init__.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bennu-0.4.1a7\bennu\mod\__init__.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
44c7f18dbb57a8a266e948284d777565

SHA1
9b2633f3823a07b5a85f08dbde31c866a8326b12

SHA256
20888adaebc4989518530597180ff288060c04809484b5418ebe125658069b9b

SHA512
39a912cbc42d16aaf84d3718eac9f46d7f27bd621379f08b8fea3eb82c06868dc88bf46bd90ff6de40e753f0cee2c64fa32ae4cbdca0d09f8b8e5abf63e1116b

Download Submit