09678a8d7caca2b0bfb457625adbd9ea58b9e280938fe5a238d2c8c3c56f267e

Analysis

max time kernel
151s
max time network
123s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-1.7.0/util/options/token_joiner.py
Size

852B
MD5

07ecb52347ad90c98b221527cc2bebed
SHA1

cea3b88ecb0887ebc04c8196c658cc88d6fb7151
SHA256

43333a83a75613a994babb01bc56fdcda59c3f79ae0a7fdfe5772e0cf669b9b8
SHA512

46f6b7bd7e09f16d2fe27b3d34149836944a8fc330b33e19381590585ef1b5badcc871e6124714a72fe9ee3c68dd5edcc4a86ac98ece6ddd9fbf7e36eb7369c2

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1740	AcroRd32.exe
1740	AcroRd32.exe
1740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2748	2124	cmd.exe	29
PID 2124 wrote to memory of 2748	2124	cmd.exe	29
PID 2124 wrote to memory of 2748	2124	cmd.exe	29
PID 2748 wrote to memory of 1740	2748	rundll32.exe	30
PID 2748 wrote to memory of 1740	2748	rundll32.exe	30
PID 2748 wrote to memory of 1740	2748	rundll32.exe	30
PID 2748 wrote to memory of 1740	2748	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.0\util\options\token_joiner.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.0\util\options\token_joiner.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.0\util\options\token_joiner.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01d17e034f93c6669459b671979a9141

SHA1
a6e72fde9e392aa3acd9726fdf219bf0fe7b6645

SHA256
e2871e1eec28c88c48a803985fd27fd6106216849655829f8b0c6e288e5a61f5

SHA512
11c95e48a553483ca79a68ab775c6eecd41933847d59bdf6552e1341386810adec231eba0e1f0e30c9bb0409d6b4da9a38e6b402d3bc7141eb8baffd5623238a

Download Submit