26cca1ec09795f47b983d21c69312fefed6cdc8806fbdbbf920b1beee1d442a6

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Xvirus-Tools-main/Xvirus.py
Size 8KB
Sample240219-typvesge97
SHA256 ea57693b77ba0d034c0b9e8a874f3251440ba793251081899ca11fb98fc86574
MD5 7b1a408c4fa7f99027bb497151875caa
SHA1 75fa713f0d8edc39e74bcbdf113ea8dc3fedfa97
SHA512 75e55264f46d925e458ecdb2362d05cdf6477b18d3f659f01d2c33f528a5cb4ac4fa03a1508eaccddab8df8595193a59cdc8e1e564ca0244f31ddc19132e4f3f
SSDEEP 192:OxGWZRZd7vnTNxTM/DTdkBf9XxrcNqTf2BXsYEJv:z0zlvnTNxTF9XxrcNqTA7Ex
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1660 wrote to memory of 2784	1660	cmd.exe	29
PID 1660 wrote to memory of 2784	1660	cmd.exe	29
PID 1660 wrote to memory of 2784	1660	cmd.exe	29
PID 2784 wrote to memory of 2740	2784	rundll32.exe	30
PID 2784 wrote to memory of 2740	2784	rundll32.exe	30
PID 2784 wrote to memory of 2740	2784	rundll32.exe	30
PID 2784 wrote to memory of 2740	2784	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\Xvirus.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\Xvirus.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\Xvirus.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8a8ded7eb30b4d116edcdda5e9366f4410d6c6c5cf0b8315dacb0d213b007885
MD5 ef4ff3bf823801a68aea1dcb6d887c10
SHA1 641cb16b4203fb27a482238c60828309293966c7
SHA512 88b88b9fd738946cbf49c834a6b53211bc81908441f25ce90ffdead0ddb2ae9133e560d574560b50c6210aac638cbb2c3098f9225a72ea5a9a7b98a1f2ffd718
MD5 SHA1 SHA512

Submit Download