Analysis
- max time kernel
1719s - max time network
1169s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
04/02/2024, 12:12
General
- Target misc.pyc
- Size 2KB
- Sample240204-pdjepabber
- SHA256 572b18ccb1838f23714fae1c8cbb399a08796b1eb846960d5463d40ee784fe5a
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc1⤵
- Modifies registry class
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
store.jfm
memory/4648-36-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-33-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-35-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-38-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-40-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-42-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-41-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-39-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-37-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-44-0x000002003FC80000-0x000002003FC81000-memory.dmp
memory/4648-32-0x000002003FF40000-0x000002003FF41000-memory.dmp
memory/4648-34-0x000002003FF70000-0x000002003FF71000-memory.dmp
memory/4648-0-0x0000020037950000-0x0000020037960000-memory.dmp
memory/4648-43-0x000002003FC90000-0x000002003FC91000-memory.dmp
memory/4648-49-0x000002003FC80000-0x000002003FC81000-memory.dmp
memory/4648-64-0x000002003FDC0000-0x000002003FDC1000-memory.dmp
memory/4648-68-0x000002003FEE0000-0x000002003FEE1000-memory.dmp
memory/4648-67-0x000002003FDD0000-0x000002003FDD1000-memory.dmp
memory/4648-66-0x000002003FDD0000-0x000002003FDD1000-memory.dmp
memory/4648-16-0x0000020037A50000-0x0000020037A60000-memory.dmp
memory/4648-52-0x000002003FBC0000-0x000002003FBC1000-memory.dmp
memory/4648-46-0x000002003FC90000-0x000002003FC91000-memory.dmp