26cca1ec09795f47b983d21c69312fefed6cdc8806fbdbbf920b1beee1d442a6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-main/util/options/bypass_rules.py
Size

797B
MD5

00d2a8463899d3a15c6de0862afd52a9
SHA1

15c0055785dde13192dfc809eff127c0c3c459e8
SHA256

6d3d030fd620ef28d68f85e565cbf30ddeaeed7da619edf229861ee5991e99d0
SHA512

f9847c1892acc0b7b6709f7e9ac9d9c715da5331adf3fb7b0abeb5505692c35927def47a60bbee23dd18e99fee7c9486527c3b586337d72712ed10e6c0841b47

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 3060	2252	cmd.exe	29
PID 2252 wrote to memory of 3060	2252	cmd.exe	29
PID 2252 wrote to memory of 3060	2252	cmd.exe	29
PID 3060 wrote to memory of 2748	3060	rundll32.exe	30
PID 3060 wrote to memory of 2748	3060	rundll32.exe	30
PID 3060 wrote to memory of 2748	3060	rundll32.exe	30
PID 3060 wrote to memory of 2748	3060	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\bypass_rules.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\bypass_rules.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\bypass_rules.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8fa28d9164de3d17623567e527653585

SHA1
1747030204c7d3c8f4bab8f8b5a6a9582f572754

SHA256
d76ac95006d5b0ab65e1459f25bca00af023ffed3bd55eb9c185b6db3bd7c2ca

SHA512
181834bdba4ee8ca527a963a8e354629ef185ec3711b6c8c590239d3046b069a2822928a3f4a71849b7bfa020bf83809f2271a08b18817b4756c2c8f4c8ff28f

Download Submit