Analysis

  • max time kernel
    155s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 05:26

General

  • Target

    exe.win-amd64-3.11/lib/Cryptodome/Cipher/_mode_cfb.pyc

  • Size

    10KB

  • MD5

    42c117d583146e0e7bf236616bf69a29

  • SHA1

    b35d32cc33586d4e473c55d37c6abacfbfebda1f

  • SHA256

    1e79692da8b0ea34acd22340e768d300172d95762832dc1b201d9bc1f79b3abb

  • SHA512

    e62576a168bcdcb65014406be1cd883b4059e837662ad944ce577b1dc38bed330b2fd3ee7d0386a001e4fdecee335ec511b2acd8f6c471ac946761f81d5c07c9

  • SSDEEP

    192:Nw3jDCxEZzorrU4B/NU4DfZZkZZZZqjbPpw:grZzoXTBFTDnjtw

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\exe.win-amd64-3.11\lib\Cryptodome\Cipher\_mode_cfb.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\exe.win-amd64-3.11\lib\Cryptodome\Cipher\_mode_cfb.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2212
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\exe.win-amd64-3.11\lib\Cryptodome\Cipher\_mode_cfb.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    380cdee106291ed2a5cb65e8c324c851

    SHA1

    52c18b40e32d645db39197946ef54743d1f8e4db

    SHA256

    f7f408ab273b713222804413798fb0fffa01c23fb07309c60e4cd630b4ad4b01

    SHA512

    f98f898a1a5e5e1b14b41b9f24311bba9e27dca57758f3f6966a93ab903a5e3ef5010d92774cf75d44f24538f9e23ad0d932cdb8169b3d23d98a466b1d7a732a