63da41f48018b8e66cf9d81a4f144ccc008f527b7134617c1a885fc2db18daa7

Resubmissions

10/03/2024, 12:40

240310-pv6ljsda6t 7

10/03/2024, 12:34

240310-prr9racf88 7

Analysis

max time kernel
611s
max time network
623s
platform
windows7_x64
resource
win7-20240221-de
resource tags

arch:x64arch:x86image:win7-20240221-delocale:de-deos:windows7-x64systemwindows
submitted
10/03/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

5KB
MD5

0811bbcd250b0fbd88c5e15787f3048e
SHA1

9498d1c10880183168d45ed11a90344e93f2ce49
SHA256

875c60c15b88add50a24ca917be2de02f1a4bbdefc83b5b73b29076ee69bb439
SHA512

6f8b835e59f6e1883b837100c49b28b2951c6992bf98ec97b7316ad0f722901b2ad99189694f81f3bf03da1fec0dc5246921a788f71a300cbd41f78a2e27bf0f
SSDEEP

96:wj0ckvndwEbhjFOWKdioHrZ0WEtfN2vBuXCmp9929t7u5zFgoA5R/pMGtml:TRv6ENHi9yhN2vI949t7Q+pR/pMG8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1644	AcroRd32.exe
1644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2552	3056	cmd.exe	28
PID 3056 wrote to memory of 2552	3056	cmd.exe	28
PID 3056 wrote to memory of 2552	3056	cmd.exe	28
PID 2552 wrote to memory of 1644	2552	rundll32.exe	29
PID 2552 wrote to memory of 1644	2552	rundll32.exe	29
PID 2552 wrote to memory of 1644	2552	rundll32.exe	29
PID 2552 wrote to memory of 1644	2552	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8bf8eda8437d90852c9066005947773f

SHA1
7fae0a12abf8feacb893fa5924704f32385bd170

SHA256
40cdbf6cd7d77d22a6288c5e3a4b0eb376b977cbf76e60d20535419d229cc936

SHA512
bfacb1d32bd9f00eb7524beab2df92fbdb544ec19e8c3cff40b2bda2feb4364c0d7167d2465e873a1cf446ab12a005d1bd47b25b806fad7f3397e08a09b39fd2

Download Submit