5df2b53ec0a58ea805876e23634cfa1030137e7f7a166396c4e00d224fccb367

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

185KB
MD5

a71ef19c0c0b55ef8996999f12d81354
SHA1

a2421c2bd459256a4902ff980c5551cdbd7d18af
SHA256

957c157de1101c3002514a95e6ac1c1984cec4a75da102f3980589494e191593
SHA512

487fa4108c5dd84d5934506caa98bc9a86ac4719f8d61f8b137b8c8bf3a7d2fdbeeb862ea3d400f1b70641153b244080b9d1acc5387c15f7efe341bad86574b9
SSDEEP

3072:wThLaX/UA9Mei9towPEtelZN+tVZasUngtXXHCkn0:wThWX/9utow8cN+7ZasUngtX3Ch

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1028	AcroRd32.exe
1028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2708	2144	cmd.exe	29
PID 2144 wrote to memory of 2708	2144	cmd.exe	29
PID 2144 wrote to memory of 2708	2144	cmd.exe	29
PID 2708 wrote to memory of 1028	2708	rundll32.exe	31
PID 2708 wrote to memory of 1028	2708	rundll32.exe	31
PID 2708 wrote to memory of 1028	2708	rundll32.exe	31
PID 2708 wrote to memory of 1028	2708	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3e4d4dbf97393ca91f0bdb4557747248

SHA1
2ebb0cdb7fabfd37cca04bcc0d67d79cc93badaa

SHA256
4ff0dc6e8605a5f666e6f725397d00a1857aa5284ba5075700cb3a00f0cbf4a9

SHA512
be66242c54a19f9cf5bdf6dd02effa774daf156428102c61666b38084bc57239f283763dfdfbeb4d6fa7e4b3ea9440b036acad01c7c3d125a4ce8c897b39ca67

Download Submit