ff2c2ae77e1b00829710601852b7dd95c4db15f332838807605e53bde54692df

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

res/scripts/client/gui/pmod/controllers/__init__.pyc
Size

559B
MD5

99e27818dc03554f49ce0228401505d8
SHA1

0926f45d1d28b3a81913fb1e628f8a5b5b614454
SHA256

eee06002d6fa8bc33a11bb88a24a4bc4bfd8ef35de112aef556bb56b5331b4f8
SHA512

1f0f7ac2c8c77dffbeaad9b228ee4bfc5a07374dd8aa3bb07d3cc02c42d3691bf0fd49eb31b2b2c060cb73ac98e042a63ac712add1e6bc4738ce36600b7b3d0e

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	AcroRd32.exe
2860	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2340	2352	cmd.exe	29
PID 2352 wrote to memory of 2340	2352	cmd.exe	29
PID 2352 wrote to memory of 2340	2352	cmd.exe	29
PID 2340 wrote to memory of 2860	2340	rundll32.exe	30
PID 2340 wrote to memory of 2860	2340	rundll32.exe	30
PID 2340 wrote to memory of 2860	2340	rundll32.exe	30
PID 2340 wrote to memory of 2860	2340	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\controllers\__init__.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\controllers\__init__.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\controllers\__init__.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f48221fbfa3030ad58a379d4281ea0d0

SHA1
650ea3584627e92b3e90a956da4f5d93a94f9f41

SHA256
d1df4d3f2039f58e4bc507057d12b627a2fcf58c750510745569b6e36a5e667d

SHA512
25cd24feb22b465c8d23c10feea80f9282a02839deef1bb01afec121e191f5d0c66e8eaf4ecf5a379273855174dec1d4e8fc944e150ccefbb113f0a475ec0335

Download Submit