e6015567f25c32599b2c0cad7e3f1213ea6df23fcd04dd3876a18e33651d8a93

Analysis

max time kernel
1557s
max time network
1564s
platform
windows7_x64
resource
win7-20240221-de
resource tags

arch:x64arch:x86image:win7-20240221-delocale:de-deos:windows7-x64systemwindows
submitted
11-03-2024 15:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ZC-AIO/modules/__pycache__/start.cpython-312.pyc
Size

9KB
MD5

dff60e11150b7e57a1fe15bbf40c5667
SHA1

bb9b2757ab1a2e14dcb5ecb36293adf7f1b0bd8e
SHA256

65eb0787fe15e8f707730d067cd2dfd1ceedede4d50c383ec1ca9d7f928034e5
SHA512

d3fc203fc306f734c1e4ca777f4b1f6c4350d4b64bfc8d91a3d5700f8ed8cacb05ea41b78b6b17bde7b4525066297971c7b1cabcf759c7b51ecbda4f223ffd1e
SSDEEP

192:Xdm6W7UpUfS+rxVJ/IqYv3rrwx6lsNH+Qtw1i+zyhkltnohHa96:xIUpUfS+rxVJ/IqYv3rrvYgi+mA2Za96

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2588	2668	cmd.exe	29
PID 2668 wrote to memory of 2588	2668	cmd.exe	29
PID 2668 wrote to memory of 2588	2668	cmd.exe	29
PID 2588 wrote to memory of 2852	2588	rundll32.exe	30
PID 2588 wrote to memory of 2852	2588	rundll32.exe	30
PID 2588 wrote to memory of 2852	2588	rundll32.exe	30
PID 2588 wrote to memory of 2852	2588	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ZC-AIO\modules\__pycache__\start.cpython-312.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ZC-AIO\modules\__pycache__\start.cpython-312.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ZC-AIO\modules\__pycache__\start.cpython-312.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fc769e107d68ea017698ab9b0e2ae06f

SHA1
38c8f75b8898d543f14397a07b44098e6b6c3190

SHA256
93ff05bd37f6d294543b857477d06f6b49891524affe1aa7e9b39cafc60e6f2f

SHA512
51e8b7fe6d20937fd7117e741a4b27e40b84dbed3eead081313a4b5c250a95ece4064ecdbf7669b60601ae73d54116ce4b9c06d8d600ecd87b592a51bc6c2488

Download Submit