dabb8843ebdedafa6b03e479a256eb3525dc8337478d292455e10567196939a6

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 17:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bots/boost bot src/__pycache__/keyauth.cpython-310.pyc
Size

11KB
MD5

5f513638177697f6c47f7684f624d85f
SHA1

0ed715bf91b7814ca059650e52dd559bd4e91308
SHA256

ea778e521372a524e0641c31e0bb714731c0a19726be969356049bc271343d23
SHA512

bab84866b602c084e051af912e9d80e541b3b73767ea7729374537ccb1f490410c72cd81009dde2dc5043fd83fed7787158c9540590daac39f6119cbaf4c3e9a
SSDEEP

192:Z4mzTHMMpXlYiGF/OFr0uA5u9p2V+dUJasBY1uAI1d7Uy08a:+EoMpVYiGFmWP5uzYzJasW1uAI1d7URh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2244	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2244	AcroRd32.exe
2244	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2568	1676	cmd.exe	29
PID 1676 wrote to memory of 2568	1676	cmd.exe	29
PID 1676 wrote to memory of 2568	1676	cmd.exe	29
PID 2568 wrote to memory of 2244	2568	rundll32.exe	30
PID 2568 wrote to memory of 2244	2568	rundll32.exe	30
PID 2568 wrote to memory of 2244	2568	rundll32.exe	30
PID 2568 wrote to memory of 2244	2568	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bots\boost bot src\__pycache__\keyauth.cpython-310.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bots\boost bot src\__pycache__\keyauth.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bots\boost bot src\__pycache__\keyauth.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2e1b9a15a822ffbb98f6175698ebfbb0

SHA1
81692ff458f5d46475ce5030079d5102cc6b11ea

SHA256
45f3898432286514abd115f7ba8476a54956c4fe9ac268201e52c3a1d738fa34

SHA512
92dfebd44bd2365006dabad5783a5a5ef48c1cd435f06f5f34c723e6b7a432bc66eb32e72fe4483289dcd1730b6b8fc5a7388793b04edf4d7be7527c2d4eea34

Download Submit