e32936e2b80a08a594498283941e82ea2d34dff6aba017e848f12b053c9bb55b

Resubmissions

22-12-2023 09:04

231222-k1vc9agbf3 3

22-12-2023 09:02

231222-kzksesebdq 3

22-12-2023 08:57

231222-kwmgvaeaen 7

Analysis

max time kernel
0s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-12-2023 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test-yUGEp.pyc
Size

74KB
MD5

63bcf387b9281fe4ab5af557f33fc41c
SHA1

fb8b40342ce244199123625aedf7df76ad23488c
SHA256

032d9585febd6b3eb89aad1f088abe52493938812179a72dcff08e13526f614a
SHA512

cb4a474a469f947b65858b00b450172f40c1279d73e698415e2c401c02d14caa691074cb9dad69868bbcef7330e61c47d281c4de0996d0fadc30ac8f54d467e5
SSDEEP

1536:FKwZq1Wa/hYx/Ys/A/ki5wD66lbcaMrW5N0G:FbZkWa/WdCsi5ku69

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2584	2164	cmd.exe	15
PID 2164 wrote to memory of 2584	2164	cmd.exe	15
PID 2164 wrote to memory of 2584	2164	cmd.exe	15

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\test-yUGEp.pyc
1⤵
PID:2584
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\test-yUGEp.pyc"
  2⤵
  PID:2612

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test-yUGEp.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a3b1366e5af3b7d4c13edac51fc8bb33

SHA1
5d5a90114a1ee1258207dd3f5c00ccda1e8314b2

SHA256
4e2ec438bbee691952cece9a583cfc022bac9fb2c39338e0e408ed64926e5ace

SHA512
337905df5d5577a314a2d6d812ce9627efa7dbbf5ef8afee10983322afcfc2e522fba580d8bd304874368fc38d070e55158d6783e6afc048a448e3c378febf19

Download Submit