2b77092e5cb4f0d889f98f312a856970bcbe151e152a05de7b1d591199bf1468

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACADEMY34-v0.19.3.4-win/lib/python2.7/chardet/hebrewprober.pyo
Size

4KB
MD5

117ccf9a5bf5d3c7c81b4446806c8ab6
SHA1

a7cb1107ad41cd7dda696af0b5fb2fb8b67bb45d
SHA256

d95da61a7d4a187991a7ca7226045416cc4f754e029578c1ea0569561abd383d
SHA512

5c06a1a3fa54779bc446f4949ad6ef7fe58df48b5d67ca3080f3749361597ad787b5096e9b7d0bb547cae7080faf672bef68db61f32050e8962d4005361e1a13
SSDEEP

48:ainNn/te65kKniiOGVsYZx7Pq9mGj8ckKc5jRvBs+W22RwHdLW6TROg21Xye:Pn9/te6qKnZlZNSvjsz5jY+BcwHdLjql

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyo	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	AcroRd32.exe
2464	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2664	2980	cmd.exe	29
PID 2980 wrote to memory of 2664	2980	cmd.exe	29
PID 2980 wrote to memory of 2664	2980	cmd.exe	29
PID 2664 wrote to memory of 2464	2664	rundll32.exe	30
PID 2664 wrote to memory of 2464	2664	rundll32.exe	30
PID 2664 wrote to memory of 2464	2664	rundll32.exe	30
PID 2664 wrote to memory of 2464	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\hebrewprober.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\hebrewprober.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\hebrewprober.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5065e915f7b186c35885a5e32dd44453

SHA1
73100e897cba182d507565333af7a9b86c216858

SHA256
87739adf6b7bc97153ab0a655fc68923fe3429cc5a7265341f926df987e0baa4

SHA512
2d77ef8f40043404171233556c7c9fdfcd64f42644896b36df81868540047eac80b87787c402cbe1a999cc64e1b12ea1e122e78e261af3d3b04a6b4c1e968b5b

Download Submit