c64078d83451736e26ad57cde3cca028d01569e1ab49c166539cb70a53334de0

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luna-Grabber-main/tools/update.py
Size

2KB
MD5

8164c328a78513b1f417296aae3588b0
SHA1

4596524bdd9d2ded8000ddec7c188ed3c1b7290f
SHA256

8656947e1cff096ba8f41702ad5c75cdab2e6d2c38a605100832b06cd8105501
SHA512

bfa226c73750ffdd2bfafde79bdcf79a1d97d8689e4121f3d2477e54d270f289389742e26711151108a8507ec439a66746e497d6877a7b0e55f6a64cb8cbdfe4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2420	AcroRd32.exe
2420	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 2604	1268	cmd.exe	29
PID 1268 wrote to memory of 2604	1268	cmd.exe	29
PID 1268 wrote to memory of 2604	1268	cmd.exe	29
PID 2604 wrote to memory of 2420	2604	rundll32.exe	30
PID 2604 wrote to memory of 2420	2604	rundll32.exe	30
PID 2604 wrote to memory of 2420	2604	rundll32.exe	30
PID 2604 wrote to memory of 2420	2604	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\tools\update.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\tools\update.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\tools\update.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e2bd110ce19c77f5c6dd231cd34f9d43

SHA1
4dbc01e22f72de23aa478915800756a0323ed6b4

SHA256
dbc199a9f582b4d89d6a28c92fbdd9febbfb37a21950822b198059f0eb260acc

SHA512
ca6f768391c4b1c5cb042f663222b54a61ad06bd8ff39f5892b55d8d7f8ba6ce2c24a2c7313d5979bc269cb9d07c9ce5813aa072a32fb12e2b3324458eefa5a4

Download Submit