Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    19/02/2024, 16:28 UTC

General

  • Target

    Xvirus-Tools-main/util/options/soundboard_spammer.py

  • Size

    1KB

  • MD5

    aeed67f5c6d83f7c9a262e5a60751d20

  • SHA1

    77405701061c7a1208fd38dd313e198df46829c4

  • SHA256

    a6cc0b409a54ac21d0662b156c029694b4fdbced30db2307ba83443502ae2f0d

  • SHA512

    d770142aedbadf384462eadb3cb40e2155d30345a668da2673df9c20127c85d6c3cc905f9c2a1e42e15f21f7c6070aa6997c5a87bbb90158f2b1a8c2769f2212

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\soundboard_spammer.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\soundboard_spammer.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\soundboard_spammer.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2952

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    f51cfbafb845fbdfdd29318788f55209

    SHA1

    2e111c2b706f23269d5d04197f7f12e5511e89ea

    SHA256

    f0f0a15c3786e7bd65a2272eb01c321caa432abd26c7869cf2b6ea4294cbde34

    SHA512

    afbe2571535abdd64d53100f8b48e95d46c198961cf3e68a6021f30d0300a493a77c7904b13b623d7db65602dfe54f4d69462f9173373aa5092caba6f0dacfa7

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.