b17d10408e97c9211d0f1f34f9592c2823c5982760209d30cff2ae263b96efc3

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eclipse-grabber-main/builder.py
Size

7KB
MD5

27d9823d19950d7681d6c474a46f69ad
SHA1

05516d8db715636203c811106597cdffb5ed7e83
SHA256

2d647ceb04e55a2f72f0e75a4c58cae5f0fd8296e4c07473c0b900437ef7e13d
SHA512

1177801ee4c55386bd2210e0e48191ca3f5407291fb2ac2e65a6123713b7817179d84a77fd15a64e80ea72ca9ce46c306a3d964f3c2d7a909c62f7f70ada12bf
SSDEEP

192:6Gh6rr4GiVLG+XFD+HIOCuqgUbTTlFh0kk8KUFP:3DV8EudkTRFh0krPF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2716	2428	cmd.exe	29
PID 2428 wrote to memory of 2716	2428	cmd.exe	29
PID 2428 wrote to memory of 2716	2428	cmd.exe	29
PID 2716 wrote to memory of 2756	2716	rundll32.exe	31
PID 2716 wrote to memory of 2756	2716	rundll32.exe	31
PID 2716 wrote to memory of 2756	2716	rundll32.exe	31
PID 2716 wrote to memory of 2756	2716	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\eclipse-grabber-main\builder.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8c9014d9306b39717bf53e5f277d774a

SHA1
b1bfef1bf15e52d0143f0bf85923e8521c5e019d

SHA256
72aef64236c08de7e2705355e01302818fb50ad37fd30041a017ac3fe840911e

SHA512
50cc11be8fd9d24c752abc61bc0598104ca28c94752f5d8e2137ea14d62ff62319a965362995a0121cec291562648b0a00b95b9b4d5debb5f1af538dcaf2f22d

Download Submit