Analysis

  • max time kernel
    178s
  • max time network
    268s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-12-2023 16:07

General

  • Target

    get_cookies.pyc

  • Size

    10KB

  • MD5

    ddc40a1cee51500039f5c98ef7b1d3c9

  • SHA1

    1e65cf0d7acb74e429844d2ee5b2d39369d17750

  • SHA256

    1201adef44d0ba8be86b7d4aa4e8f69f1f8f800522fa574291974a3b40250436

  • SHA512

    c9a89f5fe6ef87d7d8ce63a59f87fd5684d91e5dccfda644d84a40d5316b85b9930e90f096f13e811f646da724bc267ac853c15e451a6888083d5ab0572f27db

  • SSDEEP

    192:TzOCIeivQfUFPLqwOEVOFc1mNe47+S5zEzzzzz1zz+HoowAE:TzOUi4aFEe4KSPIAE

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
    1⤵
    • Modifies registry class
    PID:2152
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4344
  • C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
    1⤵
      PID:3764
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:332

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

      Filesize

      16KB

      MD5

      463ef45b7eceb98265b59cc5df638030

      SHA1

      33a9b08ae5de4a09e1ee88c1007948971e44aa3b

      SHA256

      506efaa2e9c833cb273693b21958361089125bc3261d6f79e74cbc8c9daf4aa7

      SHA512

      8a18655a309130b36448d86893ed02a412b84fb0ad9599387f5d36eada41ae19aa9d5bd8405375a6e391a49f180b7d42a0fedb8be6cecb58c9665a8846855aff

    • memory/332-36-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-33-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-44-0x00000197A7CA0000-0x00000197A7CA1000-memory.dmp

      Filesize

      4KB

    • memory/332-37-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-39-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-42-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-41-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-40-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-43-0x00000197A7CB0000-0x00000197A7CB1000-memory.dmp

      Filesize

      4KB

    • memory/332-16-0x000001979FA70000-0x000001979FA80000-memory.dmp

      Filesize

      64KB

    • memory/332-0-0x000001979F970000-0x000001979F980000-memory.dmp

      Filesize

      64KB

    • memory/332-32-0x00000197A7F60000-0x00000197A7F61000-memory.dmp

      Filesize

      4KB

    • memory/332-38-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-34-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB

    • memory/332-46-0x00000197A7CB0000-0x00000197A7CB1000-memory.dmp

      Filesize

      4KB

    • memory/332-49-0x00000197A7CA0000-0x00000197A7CA1000-memory.dmp

      Filesize

      4KB

    • memory/332-52-0x00000197A7BE0000-0x00000197A7BE1000-memory.dmp

      Filesize

      4KB

    • memory/332-64-0x00000197A7DE0000-0x00000197A7DE1000-memory.dmp

      Filesize

      4KB

    • memory/332-68-0x00000197A7F00000-0x00000197A7F01000-memory.dmp

      Filesize

      4KB

    • memory/332-67-0x00000197A7DF0000-0x00000197A7DF1000-memory.dmp

      Filesize

      4KB

    • memory/332-66-0x00000197A7DF0000-0x00000197A7DF1000-memory.dmp

      Filesize

      4KB

    • memory/332-35-0x00000197A7F90000-0x00000197A7F91000-memory.dmp

      Filesize

      4KB