9b9d3270a631ca1690ab9b5a03e213eb7731964748a57c7cf6e789829472026e

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Simos-Modmenu.py
Size

47KB
MD5

5b9b1707bdf6d2219ade95c964675033
SHA1

3f8a58729f274622fe30f08fccb671ab2da24085
SHA256

9b9d3270a631ca1690ab9b5a03e213eb7731964748a57c7cf6e789829472026e
SHA512

540e47964eca0985ca613b9e315ce0eefa91254dad07c743370a12b5befaf12674799484f2bb7829508521b99c26cfa748e095d4c91684a45d6b1a3aee65a89e
SSDEEP

768:aZb75RByZ6xc6mIx94C48bb7aICW01lfBaqyMbUTnb6w5VbAWR5u:aZb/4Z6xl9JSB1yMbUSw5VsWR5u

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe
2616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2780	2944	cmd.exe	29
PID 2944 wrote to memory of 2780	2944	cmd.exe	29
PID 2944 wrote to memory of 2780	2944	cmd.exe	29
PID 2780 wrote to memory of 2616	2780	rundll32.exe	31
PID 2780 wrote to memory of 2616	2780	rundll32.exe	31
PID 2780 wrote to memory of 2616	2780	rundll32.exe	31
PID 2780 wrote to memory of 2616	2780	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Simos-Modmenu.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5bdaafb373a598722c43a048c3b7d268

SHA1
4d0d62731cbc78e91eb04146db3d192a4d509cc7

SHA256
b51559fda5f656644b4853cf292a3690e898d75e31000dfbca7c60583d476973

SHA512
1b7033eedf534515f58be457d30546df40cf0c7398a8d7da4333a6a695b47e7b16bcef4af71d585338bb91ff28b7534cb49f995be83e033e3e1dc01889828c6c

Download Submit