957121efe0855560b01c0bccd3db912f2902edbc77270e2ab2367b087a181e7c

Analysis

max time kernel
123s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Python-1.5.2/Demo/classes/Dbm.py
Size

1KB
MD5

9fd83273defe3bd8c85c1a635cdaeca3
SHA1

7d885affa8ae964f1ee73e5d776fa494d32a3ea6
SHA256

68107cefda995eacffc1215c2d45cc16bffb0d8a685125ed8aff7d8397f15540
SHA512

0abdeb902c25b373d0f0ba599b8155d67d780b4128c14cb6fd11d6ed5c0a6e8b5df2e194d0501baa0836b3222a793a98d0cd1db41faed74ba47c0ca183538251

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2700	rundll32.exe
1664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	AcroRd32.exe
1664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2700	2168	cmd.exe	28
PID 2168 wrote to memory of 2700	2168	cmd.exe	28
PID 2168 wrote to memory of 2700	2168	cmd.exe	28
PID 2700 wrote to memory of 1664	2700	rundll32.exe	30
PID 2700 wrote to memory of 1664	2700	rundll32.exe	30
PID 2700 wrote to memory of 1664	2700	rundll32.exe	30
PID 2700 wrote to memory of 1664	2700	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Dbm.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Dbm.py
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Dbm.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00cfc94d30cdb7de08d7c3aac78c2348

SHA1
b145b21f5038374e5d042aa201233583bfa5480f

SHA256
538c0c2df4029b229022a9f72b31a8b3ecb3ccecb8c2375304554131cf9efc24

SHA512
74ec52fbaa49646539372451dedb60b6c6fcf3b262ad005a1ad61ab355f36275adbfbf4498618aa1c4c5798ec701e66e27f2ae1f7ff1ef7504406a8e1dbba2a6

Download Submit