bcfa9fc0b223c49baca3ac64ed6025355b07a67be93e482386a74748afa8e442

Resubmissions

07/03/2024, 09:34

240307-lj9bhsgc99 7

07/03/2024, 09:31

240307-lhafssgc68 7

07/03/2024, 09:29

240307-lf3dssgc37 7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07/03/2024, 09:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

EkexClient.exe.pyc
Size

69KB
MD5

2a4c573d98e6559ddc315dfc091a841a
SHA1

396ec4ae1c2845a867ddd3010db5da3be86c5740
SHA256

ad38b897bf067494c60d592e27b36d187691b66f8fb07639c6bc436f1838d775
SHA512

729096e3305421e02e3d4ddb2c2094c84bd38f264c01230bb9b127b4cf75de01bbaafb9dcf7a54d1b800521d5a59b70535ec9b6de2931a15999c71e1f3d00b54
SSDEEP

768:0+PS3Irw/gMxvCWUL8OsvPi3K2nFcWAXTxcPdCA79/GleK1AnjdRnrBI5y:0TIrYv+SNxjlJKpVrn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2692	1740	cmd.exe	29
PID 1740 wrote to memory of 2692	1740	cmd.exe	29
PID 1740 wrote to memory of 2692	1740	cmd.exe	29
PID 2692 wrote to memory of 2624	2692	rundll32.exe	30
PID 2692 wrote to memory of 2624	2692	rundll32.exe	30
PID 2692 wrote to memory of 2624	2692	rundll32.exe	30
PID 2692 wrote to memory of 2624	2692	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\EkexClient.exe.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\EkexClient.exe.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\EkexClient.exe.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b51dd73015b70b82212f2772f1a50d24

SHA1
d80352c67b044c6f862bc0548e98d405b5c6b2dd

SHA256
0e90d8214ebb845e8555cd44c0501bbe6e8cf8f1b2b80635017c92728341e11c

SHA512
da54cd714d2b955a22e36cbb96b5dca8a0fcb31dbc25926f8098600cd5acf18b0e791575b0e2de685056a12f73261b52dc8040ec116ef768ca0e3cfd65bfbb19

Download Submit