38968cd7d1bf8bf247faf15258689d178a3be9d0982807e6ceebc9b89c389f5d

Analysis

max time kernel
188s
max time network
131s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11/10/2023, 15:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

theZoo-0.60/imports/manysearches.py
Size

2KB
MD5

71bfc154118c8eb36c9cd38805ed68d8
SHA1

f6d4c91df20dde8b20089eddcd6e3812133644d7
SHA256

c6e6702a52425957468dd2dd36ed42b4db3a1fa32446629e7c23116bff83ddb9
SHA512

103b9f9f831ccd4962d410d0fb6a921792bd9ba2956710d2e65ca1c26131045b9ca21ad956565c38e1b9319b0492105342afd86e9c2e58676f4c1cb872228c58

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686452656-3203474025-4140627569-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1968	AcroRd32.exe
1968	AcroRd32.exe
1968	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2492	2696	cmd.exe	31
PID 2696 wrote to memory of 2492	2696	cmd.exe	31
PID 2696 wrote to memory of 2492	2696	cmd.exe	31
PID 2492 wrote to memory of 1968	2492	rundll32.exe	33
PID 2492 wrote to memory of 1968	2492	rundll32.exe	33
PID 2492 wrote to memory of 1968	2492	rundll32.exe	33
PID 2492 wrote to memory of 1968	2492	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\theZoo-0.60\imports\manysearches.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\theZoo-0.60\imports\manysearches.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\theZoo-0.60\imports\manysearches.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
36ec324c1fc545d78c4993f80a5997c6

SHA1
22d763b4c08d6a43805df9607d64d7a984fed135

SHA256
27f122ec569350087ea19a0d75e976c7ba0ddd108f73fdc00c83f9b3ddfaff11

SHA512
2e19c355be727cee9e92fe1ce48394655733c102a0e98b18cce2e634872cbb584479aa3129fd22fd146fbcc1e115460db304b9b44f1b48df51904c45cd23e527

Download Submit