b17d10408e97c9211d0f1f34f9592c2823c5982760209d30cff2ae263b96efc3

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 14:56

Target

eclipse-grabber-main/builder.py
Size

7KB
MD5

27d9823d19950d7681d6c474a46f69ad
SHA1

05516d8db715636203c811106597cdffb5ed7e83
SHA256

2d647ceb04e55a2f72f0e75a4c58cae5f0fd8296e4c07473c0b900437ef7e13d
SHA512

1177801ee4c55386bd2210e0e48191ca3f5407291fb2ac2e65a6123713b7817179d84a77fd15a64e80ea72ca9ce46c306a3d964f3c2d7a909c62f7f70ada12bf
SSDEEP

192:6Gh6rr4GiVLG+XFD+HIOCuqgUbTTlFh0kk8KUFP:3DV8EudkTRFh0krPF

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2820	2152	cmd.exe	17
PID 2152 wrote to memory of 2820	2152	cmd.exe	17
PID 2152 wrote to memory of 2820	2152	cmd.exe	17

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py
1⤵
PID:2820
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py"
  2⤵
  PID:2692

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2152

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact