92316f45f3acc2b7b33a12ff54b7f0b252eaed114356fb5423ef200742c2b7cc

Analysis

max time kernel
537s
max time network
362s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

updater_gui.pyc
Size

26KB
MD5

8cf02305d50c05c34a813c512e59ef1a
SHA1

ce9e83a0576e06d4c311919872e2b5b9421e3d18
SHA256

0dda534cb21f78d8e1f48ed7623281bffd8ba125b60d7178ec8eab757ab321e6
SHA512

93c752ae9a0ca5c60cea4a5f8cce0380244d7c904bd0d1c6c7cf329ec93bd89a1508c77e199cafb8be236482ddd85860fe08835737e3932be03d7c8dd6ab16dc
SSDEEP

384:ByIHEi+YG01Y2dBhBEGQwr8r0dzilJ0ABKBkKVBKICHKwwwPGD3jI+FCK9uEnn:ByIkWG01j/8M2JPo7kKwwwsTZ9vnn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2604	2944	cmd.exe	29
PID 2944 wrote to memory of 2604	2944	cmd.exe	29
PID 2944 wrote to memory of 2604	2944	cmd.exe	29
PID 2604 wrote to memory of 2892	2604	rundll32.exe	30
PID 2604 wrote to memory of 2892	2604	rundll32.exe	30
PID 2604 wrote to memory of 2892	2604	rundll32.exe	30
PID 2604 wrote to memory of 2892	2604	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\updater_gui.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\updater_gui.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\updater_gui.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b80b14c246aec7e273dfb7f9797f7673

SHA1
d1e6fc1dfed7f13af4a0d9174759ec4c85949eae

SHA256
8e5e38df8a18b17c54645472980f72c4329f121a85857c3a7466d67516dbe5f4

SHA512
3cb7fb35d02161b7e4480a93292088997280e82adf676e2bbea3b7e8e385bee97b5081cdda6101d2f76ea9aa8572919d591df2cf32557aa19b69448d9e96e606

Download Submit