d89ec5c073bdec861bb3c0dc58ef5e871553ba8667a2d497230d2327698e1cd3

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/02/2024, 05:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MCFA_GEN.pyc
Size

74KB
MD5

51d1f4cef9f8af93a03b24f3007bedae
SHA1

a374246eea5310ccce9cc2710ffa0ed7080c526d
SHA256

9e5934c8704bf3c19230a018e09a7508c4d708869dc539b8e66ed5494920e7b2
SHA512

90d2215a933f2287a4c9c026df0bb22dc7c385fa0978dee726bb9987ed47f1ce8b93532eb8a53dd2328a3d831cf5f6c5784913846b7608afe3a1ca1da98c26a6
SSDEEP

1536:hKOnFMWRgEfoIB3aFy5wu7+l3LHbrJ3kr:h/niWRgAhgFy5uvRG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2000	AcroRd32.exe
2000	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2816	1972	cmd.exe	29
PID 1972 wrote to memory of 2816	1972	cmd.exe	29
PID 1972 wrote to memory of 2816	1972	cmd.exe	29
PID 2816 wrote to memory of 2000	2816	rundll32.exe	30
PID 2816 wrote to memory of 2000	2816	rundll32.exe	30
PID 2816 wrote to memory of 2000	2816	rundll32.exe	30
PID 2816 wrote to memory of 2000	2816	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MCFA_GEN.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MCFA_GEN.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MCFA_GEN.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
04676d8e90b195bf0aa4798a5f422e40

SHA1
9014afae88518a584f877b285b44c932a70d7267

SHA256
04007a16aa6999a947a8916acce3de9059598c747e31fb51a20344a28e7658a5

SHA512
b085d13b4decee44372855a544aa975d0278c683dd0a68b5e33b5626c7f01697b22ac4562e31fe0310ec3f9c74b4b7adf38f1bcabdec66ad20b0e42e5c4993d3

Download Submit