Analysis

  • max time kernel
    121s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    22-03-2024 15:59

General

  • Target

    OAEXPTOOL/main/__pycache__/console.cpython-311.pyc

  • Size

    10KB

  • MD5

    4b888984a0d94cb5023736a25012afca

  • SHA1

    b55402e3123e2b112bf0442b5c4938eea5bece23

  • SHA256

    ee151fe50a74b8e14ab477f6fef65953b7c3f2e0f56d1199e44545f1001b4eee

  • SHA512

    4ed399478c5d4a91a0e3f940fbe3712ce4d83886f074826abde41e62b143e2c6330fd3befaf0415f956dceb8fc95a44cba247403d7aaac4b14cec07d97ba5ccf

  • SSDEEP

    192:VMQPqSKXrSQfJy6IeQknqIufZSM8hyRycSSS8C:dVKXBnIGnVufZSMisyN

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\OAEXPTOOL\main\__pycache__\console.cpython-311.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OAEXPTOOL\main\__pycache__\console.cpython-311.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OAEXPTOOL\main\__pycache__\console.cpython-311.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    c9a91c9e27f123603b5560e16a4f4453

    SHA1

    6b961268df8d4423b3dc1f170b01779ce88f0653

    SHA256

    f92ca3908a3b47b4affc673785b7981ee627ea410f008d30fbedb815bc80dc23

    SHA512

    7a5c034e9e0c47e0ae046e6601dd2022f8ea8fa3159bc4058c9846001c1bc48bad8ca6b292ec4095cd1e75ed3aaf7c7099919150e43094cc9a792bd608182851