957121efe0855560b01c0bccd3db912f2902edbc77270e2ab2367b087a181e7c

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/02/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Python-1.5.2/Demo/classes/Rat.py
Size

7KB
MD5

bd787d88e3fae8b3cb0082f4f66bd473
SHA1

7d4e0a9b66ab35502b26159aec97c114a99489cf
SHA256

0ac7eb886126e78f63a5355dd522fe290eaf8dc6c942fb4448dda9851ce9e185
SHA512

c42efb90ebfc784c02c271e30792c935945b344c75cf6cee689d246bf84294e32abca873b29d2cbe6db72d09c8c02f1868ce21bc4c6b73d3edae237b586cba71
SSDEEP

192:YrEO/fWZnqvOJb7UqvxrGM46i4OttSTYRXsFspJ:YV2gvON7fvxrGM46i4OttSTYRn/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2636	AcroRd32.exe
2636	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2164	1188	cmd.exe	29
PID 1188 wrote to memory of 2164	1188	cmd.exe	29
PID 1188 wrote to memory of 2164	1188	cmd.exe	29
PID 2164 wrote to memory of 2636	2164	rundll32.exe	30
PID 2164 wrote to memory of 2636	2164	rundll32.exe	30
PID 2164 wrote to memory of 2636	2164	rundll32.exe	30
PID 2164 wrote to memory of 2636	2164	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Rat.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Rat.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Python-1.5.2\Demo\classes\Rat.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
058e29454b94d7d43e998369f95c421b

SHA1
8ecfb5130f1a66e6aae41f217326a36990c78942

SHA256
73e75307de07a886316920f84cedbc2f214999e03130f4d5c487178a20b975e2

SHA512
df7f094804d6f6fc1448adae65b4f42450abb9486e6cb8dfd45d650fe0b11782b54bda399bfddbfcc296574273823827deb06f5602cee1d7dcb6ff877e14682c

Download Submit