05978581cc1217050324754951b3e1a8d6b6549131eaef2a114a0b762f6ed41f

Analysis

max time kernel
122s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 18:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PURELIB/scrapy/cmdline.py
Size

5KB
MD5

02b4e4de3b8df03eeaeb1cca3bd514a3
SHA1

2a749e04328fcee4d3decc6a0bc325b3244e4e51
SHA256

6ba2a619d96ca3b40ab763d202c41062ed7b260f06b499b821c3e45a57e0c4db
SHA512

1fc4e9e56540c5fccd9b7775f89dac84b7e90dcd930c64892eee7a008626a19c119ff009232a3ad1594fe852f0762556eb4b620a5b51fd35d161827a70cab8d1
SSDEEP

96:AzYkTJjXF4VCq1FwUFPjwMyLnPrV5+AyaG9wVq/ixbVIK5g5mtxBs:Az1lJ4VCqzw8PjByDh0BaG9wkqR5g4i

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2612	2248	cmd.exe	29
PID 2248 wrote to memory of 2612	2248	cmd.exe	29
PID 2248 wrote to memory of 2612	2248	cmd.exe	29
PID 2612 wrote to memory of 2620	2612	rundll32.exe	30
PID 2612 wrote to memory of 2620	2612	rundll32.exe	30
PID 2612 wrote to memory of 2620	2612	rundll32.exe	30
PID 2612 wrote to memory of 2620	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PURELIB\scrapy\cmdline.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PURELIB\scrapy\cmdline.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PURELIB\scrapy\cmdline.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d89c8f1039fe3ef8ee93a5070bb371ce

SHA1
bb7f5ab5f344fd72cc92eeda3805b4dd5e109897

SHA256
a0cedba5e45d0854a0d1be7e686887ccad1aed575644a088e78ea3db4a65affa

SHA512
87a9839d0bedee3736c6bb7bc59554472153c41e963a42b57495fbb695841ead648e9790eb91c9140721d7ac3cff2abb9446221c442fc5e5c45b920bf403a204

Download Submit