270a3676b2d5d2f568eb27f0a7749fb277e7f1db31773aa4e6f157554a47060d

Resubmissions

31/12/2023, 15:22

231231-ssdpjaggen 3

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Roblox-Cookie-Logger-main/Raw logger.py
Size

1KB
MD5

e7ec8e7cf107b0f12b2ac2dae1ae6232
SHA1

537974928d53a75714e88035c699004737e5813a
SHA256

6bf4f2bb196c032ba842c5c51ea957503cd9c1b2e4f0fe058b597fdfcae32a07
SHA512

a9ce989eb40b18b7ce162aa90e72f6fccc03f8854b24a62254ae84857ae80e1199ac022780d1b0f722f7e8b4512d47c86ecd1ef33c1a4ce967621e2475cba3f3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2088	AcroRd32.exe
2088	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2652	1852	cmd.exe	17
PID 1852 wrote to memory of 2652	1852	cmd.exe	17
PID 1852 wrote to memory of 2652	1852	cmd.exe	17
PID 2652 wrote to memory of 2088	2652	rundll32.exe	30
PID 2652 wrote to memory of 2088	2652	rundll32.exe	30
PID 2652 wrote to memory of 2088	2652	rundll32.exe	30
PID 2652 wrote to memory of 2088	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Roblox-Cookie-Logger-main\Raw logger.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Roblox-Cookie-Logger-main\Raw logger.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Roblox-Cookie-Logger-main\Raw logger.py"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
95318e4d3e47d7f9d3ce304874210568

SHA1
eaee4d2d301390358ca7c5737017ccd7a34bd7c5

SHA256
350a6396bfb5f7ef5e27764df679597984da55eec6b78487a3ff48f876709579

SHA512
7c87c486abfa1a170f6b9845edea8652b82589a45cc4fd91709cedeaaa8af17623b05d39cb56c02374bb45e894f4f8b0ff9cd26325fbdd599cc98936fc5a6709

Download Submit