2b77092e5cb4f0d889f98f312a856970bcbe151e152a05de7b1d591199bf1468

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09-03-2024 01:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ACADEMY34-v0.19.3.4-win/lib/python2.7/chardet/euckrfreq.pyo
Size

23KB
MD5

8bcc9c41e7ded8d8742541d8e9560a3d
SHA1

525ba4ffca71d983dcf5f21cfe2ce92465a1e07c
SHA256

b06ed49bb3500bee521ea5df82ce83a83ebd0e0554d00cfe6ebf3a790beb9355
SHA512

08d1c79df10b3a97992ce320e5be61a9d39a6ab3d5c29852604c24d98b7c0cc388d9699ecdfb4963138bc283a61e7f8e6d6d0c64bbd464becd8030d27cb6ff9d
SSDEEP

384:fVfvxjZBlYg+I2wJ3ZL+xyNPDuXr5yHHEwcAVfvxjZBlYg+I2wJ3ZL+xyNPD+Xrg:JjB+ePZdpDuXr8EsjB+ePZdpD+Xr8Eu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyo	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15c4dac4c4551a48cbb59f673a0528a6

SHA1
861e5420d77a91e4b23990d5629c59fbd7b3ce7d

SHA256
11625ab347e47a9c0150047e270a534fbac27e483e1df3e3f1867b4808208a08

SHA512
a0f7843597b1e543092bef47828dd4be92627dda6d747ad60ee72704d5469de44efc51ebc6471b326bcd408c6c313774cc396d4429316e200e1a609f4248fb25

Download Submit