Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    11-12-2023 21:20

General

  • Target

    misc.pyc

  • Size

    5KB

  • MD5

    fccbf8762a2d6e382b044d73c9969fbc

  • SHA1

    9530b874a2fb37cef0bdbc13775d64400c6158b4

  • SHA256

    bdadc8d5f54a135e4cad6dd398023cc5a8053619489b38d4b22e104215572f89

  • SHA512

    359b92919a585e4191bceb029e05c9af95816fc023fd5d566d4a5d9fc88b216cace2fe54dacff65decb68d9ad724386467f367a4fadc68b648a44f5b14f84d20

  • SSDEEP

    96:DSajAihmJG4n3B4SmSSSSlSSSShDwegPbbVxlj0oIHEDS5ejmw01k9Bddpq:eYAfn3ySmSSSSlSSSSeeOPVxx0oIHZeQ

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\misc.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2092
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\misc.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    7f9dc678cba7fd263e72616e28d3fe70

    SHA1

    ca219495a5a4d4e4c5f584bbf3535662663c2671

    SHA256

    df862e3947417ba8db58422044e7bd52088315fe0840439627c25baef857e3ba

    SHA512

    20316acdde2fd82b6510055e48eb924d6144d0e0535ac9acc7c0777980da6e31cd0bb34d1473df73d8519259a659e0cbd7614ef108dbc6c02e85eabbfc20d800