43d4f8e901cf19bad05ecd05fdd411b460b2eabb3ee4bc6e91e70d0b0af8032c

Analysis

max time kernel
145s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-1.7.1/util/options/token_bio_changer.py
Size

652B
MD5

962025c8a81b68cffaf8e005cb9e97fd
SHA1

6b27de20863640f612d56fccebb504d203b09c70
SHA256

2f5255735b30f655dbf7ec70c19654aad86ea9d7c96f922f0431e0ccc4c49da6
SHA512

e56c8caccab6cbf52263425d8bf5d90994216ce7d413d3038499617d7f8b057be441905a6e66eb318b9238c60699faa9e080495086a56e1577cb32788d32f25d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2452	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2452	AcroRd32.exe
2452	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 2652	2864	cmd.exe	29
PID 2864 wrote to memory of 2652	2864	cmd.exe	29
PID 2864 wrote to memory of 2652	2864	cmd.exe	29
PID 2652 wrote to memory of 2452	2652	rundll32.exe	30
PID 2652 wrote to memory of 2452	2652	rundll32.exe	30
PID 2652 wrote to memory of 2452	2652	rundll32.exe	30
PID 2652 wrote to memory of 2452	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\token_bio_changer.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\token_bio_changer.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-1.7.1\util\options\token_bio_changer.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1d41824bf78bf623479514411362564a

SHA1
349aafbd2fdcc15a5a2759b60bb0cf3871d585f1

SHA256
26103d4d0040a350940d961cf892bbe6cb9bcfb62df48f08471ef926bd5647af

SHA512
7a35350dec7187cc6756c8b6178e36ad679e6fbfc62e5eb3237480f220b0fdddaa5ca909e41a9501c4448c12fa009f2bb4074ad6bf53ec82f0cc6f6d065c5099

Download Submit