43d4f8e901cf19bad05ecd05fdd411b460b2eabb3ee4bc6e91e70d0b0af8032c

Analysis

max time kernel
45s
max time network
17s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-1.7.1/Xvirus.py
Size

8KB
MD5

fc57448db02026c736190b4ee77b572f
SHA1

18cb2d216814c9834f70f185eca3cde0e2c212d1
SHA256

67facff65be74557e19d5261402fdc42ed82715742b8365bea174a740b9453fa
SHA512

ce43c684f32d10c575677d630922f66e0de91d732fc7ff161b4290cfcf90b273579a09fe0847f3d51afcc0b175ff0e07c69351f303baa2d7d36a9a1b0040f619
SSDEEP

192:CGWZRZd7vnTNxTM/DTdkff9XxrcNqTf2BXsYEJv:30zlvnTNxTL9XxrcNqTA7Ex

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 2288	1956	cmd.exe	29
PID 1956 wrote to memory of 2288	1956	cmd.exe	29
PID 1956 wrote to memory of 2288	1956	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\Xvirus.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\Xvirus.py
  2⤵
  - Modifies registry class
  PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...