b57ec1c5a3826019b38a6e2ac756cc944730461963e74e42b3a01e174a5e4088

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
source_prepared.pyc
Size 156KB
Sample240227-y3ebpsae55
SHA256 7ec76286fc4af2a2e19e48392946bcfb625b100464810f2f5646750b075993d0
MD5 b061eac11e8209c7a9b3b6b2f6571d4c
SHA1 35e280d8c3d4e4cccb21d8d61009a76954f1a1d7
SHA512 2487b7679e550494c1ae3fb373bc622c276157feed5f0ed94671dad20eae03dd85132e5ec6faea6eb1cdf1c648c712b0224c0fc655e1e8a7d6c6e26cc919fe5e
SSDEEP 3072:L5vGaOOepzmvzPwolPZTJ0pZdo1qIvdXzCsC6L:1vGaOOepzmrwo6pc1Csr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2780	2952	cmd.exe	29
PID 2952 wrote to memory of 2780	2952	cmd.exe	29
PID 2952 wrote to memory of 2780	2952	cmd.exe	29
PID 2780 wrote to memory of 2992	2780	rundll32.exe	30
PID 2780 wrote to memory of 2992	2780	rundll32.exe	30
PID 2780 wrote to memory of 2992	2780	rundll32.exe	30
PID 2780 wrote to memory of 2992	2780	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8f3be85f694830c05ce6ba709b0f56c256579c62dc169a9d8d69b8c99e33cfd4
MD5 b4f99316b91646b4a0b29c1dab13f92b
SHA1 cb45ceadcd5a8b8b9ff271bdb5be5fe2420084bd
SHA512 e185ba7819689a26d695abb3d4ddbfb509d58e07d35e5dbcb2391958129c559473b7c23b6d98d1bd487c11f553750327b0c5e7115a360a5f8ce3d452d3eab65e
MD5 SHA1 SHA512

Submit Download