2b77092e5cb4f0d889f98f312a856970bcbe151e152a05de7b1d591199bf1468

Analysis

max time kernel
121s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACADEMY34-v0.19.3.4-win/lib/python2.7/chardet/jisfreq.pyo
Size

43KB
MD5

5901cbf6cd7e10784f04922a7310f12f
SHA1

9931fd84fa6bcf3d906807231bebccbf73a8bead
SHA256

b9648a1ceb0d9066acfab461f963dfe66861362fa30a9586ddb6e10906251175
SHA512

292b2181c14c038beee2c6e1e3c4fde3d2ce6c2d548078c65a5826aaa6bc21460a86133e54f43f76ae5515bcd4081513ff497744fa7ba822e8dbd0f907cfde50
SSDEEP

768:nW6fVDSPcnwwbbTMtA6I6qU4jUn4618iUXW6fVDSPcnwwbbTMtA6I6qU4jUn461J:nHVOEn9fTZ6Ig4jeAZXHVOEn9fTZ6Igh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.pyo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 2556	1496	cmd.exe	29
PID 1496 wrote to memory of 2556	1496	cmd.exe	29
PID 1496 wrote to memory of 2556	1496	cmd.exe	29
PID 2556 wrote to memory of 2440	2556	rundll32.exe	30
PID 2556 wrote to memory of 2440	2556	rundll32.exe	30
PID 2556 wrote to memory of 2440	2556	rundll32.exe	30
PID 2556 wrote to memory of 2440	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jisfreq.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jisfreq.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jisfreq.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d611fc07816752ad5dec41a85c57476

SHA1
542da795736028d13bb92ade5a9696a00fcb2ed0

SHA256
4356356e28e0fc2c4d15e601d8861717718bc5d34d4cdc4c4ca2f7383f2d4805

SHA512
c30b9909e775d2b4da6a313f6cf08990a30e0e8b0391b03b54990ce6dd64d64cd763ccd98fce4f2bba175ca32493e4abecd6610e19bf393d685ebfab0c83c5b8

Download Submit