a7fd1dd724af0b47c6a3659707f392d119d56210b2869ca62adb939a62be8858

Analysis

max time kernel
117s
max time network
131s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Dr. Yuuko's Sex Practice/renpy/lint.pyo
Size

21KB
MD5

127a6698e884350e9007461e2af07d84
SHA1

ff2c154b17077021e8c22f621666a9999cf21406
SHA256

e5d6551b02d0b1be8f8e4477692478cac80e6d992c437bc55d15c7fd736b9480
SHA512

e8ed30ebc145cd836eb5e605d516f7717542dedeabea8f92e40c9b86ffc04c598bccfe3e80781027d9b0ec7fcf17444055f10e52467e9353579ebc6d5ea7696b
SSDEEP

384:R74Wx0cgo/ZieKz2A6A6BoOutAxpF3lk1iL+JI4jbBsB7VWo6:F4E0cnZiUA6A6Bo0xj3lDCJrj106

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyo	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2672	2188	cmd.exe	29
PID 2188 wrote to memory of 2672	2188	cmd.exe	29
PID 2188 wrote to memory of 2672	2188	cmd.exe	29
PID 2672 wrote to memory of 2828	2672	rundll32.exe	30
PID 2672 wrote to memory of 2828	2672	rundll32.exe	30
PID 2672 wrote to memory of 2828	2672	rundll32.exe	30
PID 2672 wrote to memory of 2828	2672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\lint.pyo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\lint.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Dr. Yuuko's Sex Practice\renpy\lint.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
95aba3db044c31c7d025bb574999abbd

SHA1
610152b1582cdeb514d185f410727521c647164c

SHA256
79726374bed57d98f874bc63d243afa2724460026ef3ac1e733ef966d0c2193b

SHA512
b867b8f82c6844b295822e23db0523d5af4f39b91b95001cce90d415e21e52d726a97ea12915970517ce17ddaf9a107b71037399cc948eaed04fb92eafc8663b

Download Submit