aaacaf1b55ebd27f9069f78160cf17efb8b37fedc5a5d03da628d4b7e35af913

Analysis

max time kernel
185s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Prueba.py
Size

3KB
MD5

d169f0adc6920663e5c7898b9357de38
SHA1

ed81a61f36e904ce8ef1ff1be6b976764da2a63b
SHA256

aaacaf1b55ebd27f9069f78160cf17efb8b37fedc5a5d03da628d4b7e35af913
SHA512

b4eda864a472628b61c81b41d1fc5cb135108210ece237916e74eb5de264a415f959a6b88a41cc708e1a7d3621f060e6ecc2042b25fe436da24f44d2328d88af

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2692	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2692	AcroRd32.exe
2692	AcroRd32.exe
2692	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2760	2980	cmd.exe	28
PID 2980 wrote to memory of 2760	2980	cmd.exe	28
PID 2980 wrote to memory of 2760	2980	cmd.exe	28
PID 2760 wrote to memory of 2692	2760	rundll32.exe	29
PID 2760 wrote to memory of 2692	2760	rundll32.exe	29
PID 2760 wrote to memory of 2692	2760	rundll32.exe	29
PID 2760 wrote to memory of 2692	2760	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Prueba.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Prueba.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Prueba.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8cf26228598416060b5bec7994547d12

SHA1
8fad1516380d3d134900ddb10c1c27ddf8cb62d6

SHA256
c2ac02b5681ff2f5dd65f01ac240d2d874221729f50187f0bb50e03ce9928403

SHA512
8eba4332eaada3cfd7e9e0da9c0f55ca46d74d97ff821e894ea9e8691a7461002c9cc116361d0b0ca89341debfd1d78c50e5bc78e249fa15787c3e237ae677b7

Download Submit