43d4f8e901cf19bad05ecd05fdd411b460b2eabb3ee4bc6e91e70d0b0af8032c

Analysis

max time kernel
137s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-1.7.1/util/options/soundboard_spammer.py
Size

1KB
MD5

aeed67f5c6d83f7c9a262e5a60751d20
SHA1

77405701061c7a1208fd38dd313e198df46829c4
SHA256

a6cc0b409a54ac21d0662b156c029694b4fdbced30db2307ba83443502ae2f0d
SHA512

d770142aedbadf384462eadb3cb40e2155d30345a668da2673df9c20127c85d6c3cc905f9c2a1e42e15f21f7c6070aa6997c5a87bbb90158f2b1a8c2769f2212

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2640	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2640	AcroRd32.exe
2640	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2168	1984	cmd.exe	29
PID 1984 wrote to memory of 2168	1984	cmd.exe	29
PID 1984 wrote to memory of 2168	1984	cmd.exe	29
PID 2168 wrote to memory of 2640	2168	rundll32.exe	30
PID 2168 wrote to memory of 2640	2168	rundll32.exe	30
PID 2168 wrote to memory of 2640	2168	rundll32.exe	30
PID 2168 wrote to memory of 2640	2168	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\soundboard_spammer.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\soundboard_spammer.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\soundboard_spammer.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee814e80e012b4314c305cc6e7fe3d9e

SHA1
47c13972b1582ea3751d6bb4c30223eada0a44d8

SHA256
a5ed77529447c52d9b51e82d37cb2b9bcadf73243b5d33a58e199db538fb52fb

SHA512
edc57e334a149b5aa20e05b24ae99f87d4333276ab12149d6afd741d7c1c073d356e82e94fed23e318c669285917b8df1200fef380c4cad14f3f00afaeb53906

Download Submit