eb19dd67fdae4ca09fd29f17308a4fb82a29d314b7e067bc5d4119e8b1ae914f

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
15-11-2023 16:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AIMi - AI Aimbot/lib/detect.py
Size

6KB
MD5

289a91d3aaf0ea3169c95e02e1054dff
SHA1

85943431295ace72c48486b78d6909217af95481
SHA256

c596e59ab6324bdd124916598c58ac015276b4f9af35379a8d31f6537f8e4b01
SHA512

b366521541568c162d7617900f573f9407f447d0d902ebf22d28fae618d4cf501434230b959a0710d36762a82178b9e73170147e711ae6a93f2f7f92e63263b0
SSDEEP

192:k6HgEevwuAskNRLl72ueTn8tQrUMzGtHp:k6HpNRRegQrUMzGtJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 1124	2096	cmd.exe	29
PID 2096 wrote to memory of 1124	2096	cmd.exe	29
PID 2096 wrote to memory of 1124	2096	cmd.exe	29
PID 1124 wrote to memory of 2704	1124	rundll32.exe	30
PID 1124 wrote to memory of 2704	1124	rundll32.exe	30
PID 1124 wrote to memory of 2704	1124	rundll32.exe	30
PID 1124 wrote to memory of 2704	1124	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\lib\detect.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\lib\detect.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AIMi - AI Aimbot\lib\detect.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
57ab8e9f80af32e48c83d27fe127fce3

SHA1
e83ab7356f19e9c1ccd6782be3bbd73726311467

SHA256
9a1ad03b6f66acd4f507da5eecf54bd39c8dd29e17821da37d49eef958a80323

SHA512
73060db149e25c7758a822292e719d153bb3ddd976c0a15171c545684681822f6409eddc3b190bb9b5b4598e30327d2fff6d4151cb80c787566bed49c082b13d

Download Submit