a7fd1dd724af0b47c6a3659707f392d119d56210b2869ca62adb939a62be8858

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18-02-2024 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dr. Yuuko's Sex Practice/renpy/minstore.py
Size

3KB
MD5

bbca3e283fa53f1b4a6ef9e7c7c6d400
SHA1

324659452ebe31ce12f0096234c6c574f08bd704
SHA256

0df3567d4c56976d23b109ea2fd24fe142527cdc38740ffd9e69d93e406b59f5
SHA512

d0f37a46fa9d4dd735d18bed234f6ffd73d3edec0e537fea200c991c21a8e5610d605d6acabe7cac600396215bfb80c6449b9c5f156c48ae142d77b49c47677a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.py	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3028	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3028	AcroRd32.exe
3028	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2572	2352	cmd.exe	29
PID 2352 wrote to memory of 2572	2352	cmd.exe	29
PID 2352 wrote to memory of 2572	2352	cmd.exe	29
PID 2572 wrote to memory of 3028	2572	rundll32.exe	30
PID 2572 wrote to memory of 3028	2572	rundll32.exe	30
PID 2572 wrote to memory of 3028	2572	rundll32.exe	30
PID 2572 wrote to memory of 3028	2572	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\minstore.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\minstore.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\minstore.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7321448b43c394751c3c48e9ff499af6

SHA1
2f882b2ae76504fa730af666207a9d59dedcc8a7

SHA256
d17640aab47c4d8af6f422e466f926c1874a59529dcd954054011862ffe1a99d

SHA512
af7d792ad3fbb6a7ff528c77a9ff0866a2e9c7e5ad446f3d17a4536d765fb25640b2af3f397ed0bebe0cdc7e34f5b760c214ca04686b9b1c3d18c7104c646c2d

Download Submit