e501bb0f2315d61eddbe2d93bc7a31cb63098ed4e7aad3adb2e46fa089756460

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-02-2024 14:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OURTanks_setup/util/options/__pycache__/channel_spammer.cpython-312.pyc
Size

8KB
MD5

f7c9285204e0a031610fbaed495242b4
SHA1

aa98d9dd0792922b91e0faeaed6a8201000a75c1
SHA256

78806af117b7857c94940b705798ff9b79f7764ab1e9a134a78d49b20a0b51ef
SHA512

6a40c253e3494ad6572e6adfbe280c45d7440afe4c642091c7d73461f5fb9e8edf0410a8d96a345586aa6d5fc8e74f2cf5c74745af9c6c6e09e152c05c1aaf4c
SSDEEP

96:DcpXmf1OVvmN9D7kbzncFjUlX6SFrGwlqFAhgf62:kXmf1OUz2KolXJHUFA2f62

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2296	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2296	AcroRd32.exe
2296	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2632	3024	cmd.exe	29
PID 3024 wrote to memory of 2632	3024	cmd.exe	29
PID 3024 wrote to memory of 2632	3024	cmd.exe	29
PID 2632 wrote to memory of 2296	2632	rundll32.exe	30
PID 2632 wrote to memory of 2296	2632	rundll32.exe	30
PID 2632 wrote to memory of 2296	2632	rundll32.exe	30
PID 2632 wrote to memory of 2296	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OURTanks_setup\util\options\__pycache__\channel_spammer.cpython-312.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OURTanks_setup\util\options\__pycache__\channel_spammer.cpython-312.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OURTanks_setup\util\options\__pycache__\channel_spammer.cpython-312.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9730f8ea38d3a157399583f0962dbf34

SHA1
7347786ae76f1901eed5e974ec4c81b71b02dbee

SHA256
6714f9cc63e15a4234623838ea1596266a04e06459d4a4dc7d0a003937e9db85

SHA512
d8c3ce66ec18401beb7efdf724ca6c029dca6d3385e20be686b7538f4dcd8a27f6f6a9823695fc86ea51b5675ce5526008b925f833a46a4211555aab53b60700

Download Submit