fd6daddc63fc8f8f84e6fccfd95d3cc30db7231c0e2a6ee1e81efa0583794bf3

Resubmissions

25/02/2024, 10:46

240225-mtz19shh42 3

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

stable-diffusion-webui-master/modules/codeformer/codeformer_arch.py
Size

10KB
MD5

f25cdc77bee519f718ee3e7ed4be6c1c
SHA1

1457b19e8304f52364c73d2e6e00787fd1776c34
SHA256

5f6c0ce94e5700e5c82fdfae0508e7f749913d1fcea8ab5f46c830cc4f249ca2
SHA512

3ab4769ecf935c224c17f3f2b8780acb81a4378a7db720bec10def6e0f7c4ef225605f79551212802551cdceb223e9e61a20407e3dc5a251a569b2a88fe013d3
SSDEEP

192:63IK+qMdZROp5IbTdZhVW4sHsHBBoSkUPuy+aFRQ1kV:63Lp5mTdZ/W4sHst1Pu6M4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3052	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3052	AcroRd32.exe
3052	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 2668	1428	cmd.exe	29
PID 1428 wrote to memory of 2668	1428	cmd.exe	29
PID 1428 wrote to memory of 2668	1428	cmd.exe	29
PID 2668 wrote to memory of 3052	2668	rundll32.exe	30
PID 2668 wrote to memory of 3052	2668	rundll32.exe	30
PID 2668 wrote to memory of 3052	2668	rundll32.exe	30
PID 2668 wrote to memory of 3052	2668	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\stable-diffusion-webui-master\modules\codeformer\codeformer_arch.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\stable-diffusion-webui-master\modules\codeformer\codeformer_arch.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\stable-diffusion-webui-master\modules\codeformer\codeformer_arch.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
358269e487ffa68bde317197678a5f55

SHA1
188ecd5a435dfc2894e37610d96fa126807ce12b

SHA256
6dc2f7e6c3f9a80c86fec451588677d2b235e40f6f6a9360663bc3cc8ceb8261

SHA512
02e009427956de86e02687fa6dd119c7f195fc2d393e3131c1d058c3c882f4c9b4a48801044ae7f67df1dd5caeb486e4daf1cdc1ec7eee1f53daffb0ec674415

Download Submit