2b77092e5cb4f0d889f98f312a856970bcbe151e152a05de7b1d591199bf1468

Analysis

max time kernel
121s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACADEMY34-v0.19.3.4-win/lib/python2.7/chardet/jpcntx.pyo
Size

25KB
MD5

4dab9674648106c6cdfcaf8d791e50b7
SHA1

eb699c4fd30ea21788399e9ba3e64dca88a74c81
SHA256

89839831e4cc751e359ac932e7243ce261134f900562b58f789f1a6af1ec9251
SHA512

c7d6a39ee1ab235b0ed4e1a03ac90f15dfc3995e02f4a29f392b7226a21309c6edc59191760eae3de19163b2f44a1126cb68014242b1ad9aa16e8662408417b7
SSDEEP

768:MVUvQL5sUa/QauIeVLHxWmzCFj4FvDix6IZib64hdlvWqR0OARvrE2WiABZTj6ee:Yk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2864	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2864	AcroRd32.exe
2864	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2448	2876	cmd.exe	29
PID 2876 wrote to memory of 2448	2876	cmd.exe	29
PID 2876 wrote to memory of 2448	2876	cmd.exe	29
PID 2448 wrote to memory of 2864	2448	rundll32.exe	30
PID 2448 wrote to memory of 2864	2448	rundll32.exe	30
PID 2448 wrote to memory of 2864	2448	rundll32.exe	30
PID 2448 wrote to memory of 2864	2448	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jpcntx.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jpcntx.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\jpcntx.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a673761831ad8a00e561d260451d7337

SHA1
6792516be0bc1dc6410f5d43728d15a3f55fe1ba

SHA256
8d95d5159548f333dfc24a38cd6fddeb9317b7a010135262153da6da29eb0918

SHA512
1df926d860f8711c3cee1518e1534c265e4ce1c4576163666751d175df1a5fe17cedccc8e4e38e876777de9393fa317956f1f8f72f0ff66a7c5cff845fafe4fc

Download Submit