e21f95fbef0c92301602b911758a7c163ec7ce57bc1e7bd639a57a8e482a1d61

Analysis

max time kernel
1566s
max time network
1567s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/02/2024, 19:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

massdm/main.py
Size

13KB
MD5

0c0b063fd46da68ee589501a08959bed
SHA1

a2f5660d975f02e587e289102777e8b98cdbb234
SHA256

f8e1ceca8b109730c3450d280c9f62fb98afee0338118070e2c7f2793e46c691
SHA512

9e5dc1db72dec6133609659f893f3da1cf6c7f6a67c4fcb685046dd377c15247a797eb900ed936717632a3db35348f17c0164b58dd861dfcf62755301fe2c3e5
SSDEEP

384:ZYWfBQ7c+whoif5au2QB+cQnL+UiPU9YD:ZNQ/wWif5H2y+c29ic4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
848	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
848	AcroRd32.exe
848	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2632	3040	cmd.exe	29
PID 3040 wrote to memory of 2632	3040	cmd.exe	29
PID 3040 wrote to memory of 2632	3040	cmd.exe	29
PID 2632 wrote to memory of 848	2632	rundll32.exe	30
PID 2632 wrote to memory of 848	2632	rundll32.exe	30
PID 2632 wrote to memory of 848	2632	rundll32.exe	30
PID 2632 wrote to memory of 848	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\massdm\main.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\massdm\main.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\massdm\main.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7c47d1b338a5823bccec5f55b068eda7

SHA1
38d8bce1b9714153ab774a992fffe2ca54f7e5cf

SHA256
ed04197afcd1fc2b9d165741a19fe519df983a17115584bb53c2712857265452

SHA512
392ea58b11083db5e1054695693c8569a49e350c0ebc01e26bcfbf63ea778615f2a983ec35b469382d4b31a9b4815fc2fd09d282923d91c022a998508265fd67

Download Submit