97fc9ca5e07295a9d9d91b8808a6a30e302fb66f7cc103aaf87501d8f8fb54ad

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
17/11/2023, 03:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rose-Grabber-main/resources/source/bin/games.py
Size

10KB
MD5

25a800f59d389d11d68e240b34bc742e
SHA1

c73b4da85d60fa39e94526224777b5a5f5e9d4c4
SHA256

844c4cfb9f4a91be769fdc5137e44e1c68e88a6b6128c96a54f0010eb76c65a4
SHA512

970642fed60c5dffe3fe5c939cf76efbd6021d40329dae287c2e747cad93a27fd8791640cb1645efb4eec8c4d1e3eeded21f701c19f72e0641387e31e4b7925d
SSDEEP

192:me3nBazh91dB9/TYx3/Zv3/N3/vD3/N3/4J3//3/NJ3/p3/oj3/X3/mRcpN3WWS:l3BaJ9/Qxv1XD1wJnVJRgjfeRcpN3RS

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1048	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1048	AcroRd32.exe
1048	AcroRd32.exe
1048	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2264	1612	cmd.exe	29
PID 1612 wrote to memory of 2264	1612	cmd.exe	29
PID 1612 wrote to memory of 2264	1612	cmd.exe	29
PID 2264 wrote to memory of 1048	2264	rundll32.exe	30
PID 2264 wrote to memory of 1048	2264	rundll32.exe	30
PID 2264 wrote to memory of 1048	2264	rundll32.exe	30
PID 2264 wrote to memory of 1048	2264	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rose-Grabber-main\resources\source\bin\games.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rose-Grabber-main\resources\source\bin\games.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rose-Grabber-main\resources\source\bin\games.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
887216c5ed0b2ee3af4f3061d0328ae4

SHA1
72e998f6ee9e3f3bf52f88e49d7af0e943dfad0c

SHA256
28ba03b1e85c26a818858beeac701e6f4e32408c73eb0ade0de8979d6ed6ddb5

SHA512
9731df2eb78be43f230982dce3284311c632dc55e1ca166b25412c979675923c351e4b9e94980b23497cbc44f452618eb29317a6e9fa4db3d07a3461a4767645

Download Submit