23dd6c27345786926621c5ddb713b8d93b7774b92fd1f78993a8800a536f8c3c

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
14/11/2023, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

uzisexternal.pyc
Size

45KB
MD5

ad768d8d998eddee1a73d7d15c0fc2d5
SHA1

ba75e8ff9f060773be5a1e2fe64ef0004412ad9c
SHA256

45636309f17e915dac21c3a2e453f12b56eee8c3deec68730538c2485d3664de
SHA512

813bcc3e77fa7a903af5c75982b6b61db55a7f4b2fe37040ae07c8cba41f6c2de7dae2a361d691a3705fc9282213508d6cfd6ee945c160759f78b0cd2501f2f9
SSDEEP

768:n9JWpJ33N/mIlx2tqEF8vmRRBZbSiYi/p9ivKgVjwK4EVrKAM8D+hzmiaQf1Dlh8:n9JW/3s4x2tqEu2BF5cvVj7lFuQiz9DA

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2820	2944	cmd.exe	29
PID 2944 wrote to memory of 2820	2944	cmd.exe	29
PID 2944 wrote to memory of 2820	2944	cmd.exe	29
PID 2820 wrote to memory of 2924	2820	rundll32.exe	30
PID 2820 wrote to memory of 2924	2820	rundll32.exe	30
PID 2820 wrote to memory of 2924	2820	rundll32.exe	30
PID 2820 wrote to memory of 2924	2820	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\uzisexternal.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\uzisexternal.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\uzisexternal.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0fa3425378fa059c8ab7f40b4d96f951

SHA1
619845bf9602edc5b8fdb90ef33813a002b02b9e

SHA256
2cb6a3e884739f25991ac7594c52d54efae81fcd1ca89b3cf3585723638617a3

SHA512
1ee7ab765689b9549f5b7208bd02c5a7cfcc3fa57c0e1bc9477186166e1f46cc6d103c96f3b19bf3d73c74a82c3e62c4632ea96abe7784d63340fea19b603100

Download Submit