e0af29e2448b3fe6280a446a72158a7262e7800924943aa72faed9d59a144849

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/01/2024, 07:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tsuy/tsu.py
Size

2.0MB
MD5

b6cbae3589df7a27896135ee8de08a9e
SHA1

acbd9cb854f8b8dfa20eb1ec9a952b5940aeb84b
SHA256

b60b75cc716ecc25a92942ef33d43a89c0bcd27a1a1a5978a2c7231f39661442
SHA512

885d794aa442d3e1435734e6b72eca0513a8bde943a0962c6b5c92a617aa9fa1e26ed45956d09ca69cb7af4134c9f7cc1877f1878dcc477d6c6bd79aebd2691a
SSDEEP

48:t/9jp1djLZX/9jp1dLvJ9pjrPLLZBpj/d9n1tlXJdX/9jp1d9n1tZBpj/d939pPg:O

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 2068	3032	cmd.exe	29
PID 3032 wrote to memory of 2068	3032	cmd.exe	29
PID 3032 wrote to memory of 2068	3032	cmd.exe	29
PID 2068 wrote to memory of 2856	2068	rundll32.exe	30
PID 2068 wrote to memory of 2856	2068	rundll32.exe	30
PID 2068 wrote to memory of 2856	2068	rundll32.exe	30
PID 2068 wrote to memory of 2856	2068	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tsuy\tsu.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tsuy\tsu.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tsuy\tsu.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f80a1afbff8a28857a2dc3a43f19a860

SHA1
6fd3f825983c6985ca17b56c86305ac71fc82c28

SHA256
4fbdb4217beca7c9a8b1a96646df50740a135696f5c87118636bd3ec4bffe7e6

SHA512
6b8425fbd43e24075eefb83d3434dac8f9f7651200becfe45bf31cdd0ca9707d3828b0488815ad557f76ca73be0f8be592cc304d5b219cbab9eea13f8e3340b8

Download Submit