1534753294da77aca8a7fc3c6f1008f8590a5a22794fda39d1876c603c82d04d

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 15:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UGC-Sniper-main/main.py
Size

15KB
MD5

6d623b7781f15711e5e9eacf16fe61eb
SHA1

fda3729d214e55a52cc5c18271caf28608109eb8
SHA256

9730d3149808adc08b29277d42860c1c4fc7a6838488a3cc52fcd9443a3ccebb
SHA512

1bec6c74ce56176fbe2c7d25549f492cf5c37a5f659ba0d126153d7dae09ae4043ed51670818fe02dde7bfd089a7e5a773d1ddc92f56ea23588c330d9fe13a74
SSDEEP

384:SleRrcJeTokTxT0C38S6+hcTtiVuiBFzc:SorcJ6oI90C8d+hANz

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2460	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2460	AcroRd32.exe
2460	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 2576	1508	cmd.exe	29
PID 1508 wrote to memory of 2576	1508	cmd.exe	29
PID 1508 wrote to memory of 2576	1508	cmd.exe	29
PID 2576 wrote to memory of 2460	2576	rundll32.exe	30
PID 2576 wrote to memory of 2460	2576	rundll32.exe	30
PID 2576 wrote to memory of 2460	2576	rundll32.exe	30
PID 2576 wrote to memory of 2460	2576	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\main.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\main.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UGC-Sniper-main\main.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8a46cd7f27d24d3d4e35a38e716c6534

SHA1
ee2d559be5f571bd44ded42d243916bd0b187884

SHA256
e5466b8ef2ec36ce4af864966b54d613c048fb709bece3773b1e6d8a0260c4df

SHA512
7d57d70f1cdd601350946072e761cf8d8d58030080be1cc1b508e7e3128f6ff6abbf6424762fc9bd11bc1eda70f5f490634ba7a628a1757df25d9c01f2a69651

Download Submit