2b77092e5cb4f0d889f98f312a856970bcbe151e152a05de7b1d591199bf1468

Analysis

max time kernel
118s
max time network
132s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ACADEMY34-v0.19.3.4-win/lib/python2.7/chardet/euckrfreq.pyo
Size 23KB
Sample240309-bngf7aba87
SHA256 b06ed49bb3500bee521ea5df82ce83a83ebd0e0554d00cfe6ebf3a790beb9355
MD5 8bcc9c41e7ded8d8742541d8e9560a3d
SHA1 525ba4ffca71d983dcf5f21cfe2ce92465a1e07c
SHA512 08d1c79df10b3a97992ce320e5be61a9d39a6ab3d5c29852604c24d98b7c0cc388d9699ecdfb4963138bc283a61e7f8e6d6d0c64bbd464becd8030d27cb6ff9d
SSDEEP 384:fVfvxjZBlYg+I2wJ3ZL+xyNPDuXr5yHHEwcAVfvxjZBlYg+I2wJ3ZL+xyNPD+Xrg:JjB+ePZdpDuXr8EsjB+ePZdpD+Xr8Eu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyo_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyo	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 1708 wrote to memory of 3040	1708	cmd.exe	29
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30
PID 3040 wrote to memory of 2592	3040	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ACADEMY34-v0.19.3.4-win\lib\python2.7\chardet\euckrfreq.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 11625ab347e47a9c0150047e270a534fbac27e483e1df3e3f1867b4808208a08
MD5 15c4dac4c4551a48cbb59f673a0528a6
SHA1 861e5420d77a91e4b23990d5629c59fbd7b3ce7d
SHA512 a0f7843597b1e543092bef47828dd4be92627dda6d747ad60ee72704d5469de44efc51ebc6471b326bcd408c6c313774cc396d4429316e200e1a609f4248fb25
MD5 SHA1 SHA512

Submit Download