aaef823754d1230108212fee796ee805553af7067111f3b8e51a3cbe62e3e9d3

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Zero-attacker-Zero-attacker/zero.py
Size

2KB
MD5

29156f1420c9b5facda6e5b08d605399
SHA1

91b7600c7493c9e3e9dbdc26185d8ccfd0a817d2
SHA256

20c5b067169dfc85d6b007af0f4db406908062c80e145ab889048ca65b37271e
SHA512

0bd18ec5188bef93239963a922a5562b87045a8ccc296d2ce637a1d73dc1995de5687f50abc8b9875390346b601ea150792550dd84b57495a128022228fbd5dc

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2360	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2360	AcroRd32.exe
2360	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2564	2912	cmd.exe	29
PID 2912 wrote to memory of 2564	2912	cmd.exe	29
PID 2912 wrote to memory of 2564	2912	cmd.exe	29
PID 2564 wrote to memory of 2360	2564	rundll32.exe	30
PID 2564 wrote to memory of 2360	2564	rundll32.exe	30
PID 2564 wrote to memory of 2360	2564	rundll32.exe	30
PID 2564 wrote to memory of 2360	2564	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Zero-attacker-Zero-attacker\zero.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Zero-attacker-Zero-attacker\zero.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Zero-attacker-Zero-attacker\zero.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9a3f592d81bf860a28520961d923fdca

SHA1
b3809b9148ad57b3e7e95d4402003d6f46ad9d67

SHA256
d050f8a42785f81a0ec2dcbbe31fdef0531b69d77d6bf7c02c0e59f0e4f2a601

SHA512
d0fb30a6acf93b9daae3fe73f6123baa9782e47fd98f9517de70bb050c1b23c2a2110def6b3746ae3c6c6d0493ce93ca3fcc18b0298e5676a49dfb6762ff7179

Download Submit