Analysis

  • max time kernel
    1560s
  • max time network
    1562s
  • platform
    windows7_x64
  • resource
    win7-20231201-en
  • resource tags

    arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
  • submitted
    02-12-2023 19:43

General

  • Target

    passwords_grabber.pyc

  • Size

    8KB

  • MD5

    83598b70aceb59c6110ac775b51d5b64

  • SHA1

    2838321de9ef685a66af1157ef18d2ac4d9c06ab

  • SHA256

    ea26e61dc4ebafcb02301290a96e6fb91ea4df1c111eb6a85f156d95c3c5d8c1

  • SHA512

    c8805e7f8a4c4635b44b7611f559de53e8d90c4411631a69dcb9453e7dad13e114efa57793848717da9f410c06d194210406681a52925a0d1dec5f326f61dfd5

  • SSDEEP

    192:+CE34EAL/GFf/PomdPO23NsDmqFUhkxrvP9VRvM:Y4EAL/AfRBO8NsxuOxZw

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2648
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    32ceb3d8a2d649dbec137c30fda08d4a

    SHA1

    fe4e90a1ac964e6e1506ca6892de72aeee5b2eb1

    SHA256

    35682eb79a67868a4807a1b7f5d35cb2bed6997b477db165715c9d9aaee8b1e5

    SHA512

    f9cb4da7b18bac1af0c0239141a54bd89d438bd82c2fc27119f87eb8e7ce0b6b4fc4320dfb2934fc0509ed1d664647fef894da40198afda9874cbf20f3cf7e1b