0ecfa9e9370f383a669aad9db9a28109c24226496b519e7383713c7c1deaf861

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
22-03-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chronos/src/utils/__pycache__/deleteServers.cpython-310.pyc
Size

875B
MD5

b7fd0146b343cc6e6041ad013de4b435
SHA1

880d011c72cd0b656f840a7f82ef11e2f3af0383
SHA256

561c730b97d55c0b0b8f6c505571137bb518299c38f5b52909f0ac8c558c9f8e
SHA512

b443f9c608a78bc6f67049182cb37c6fe007d3515447d6211f240ff00fb10ecb1b457c302ec904328cd74453ed43d29cff060fa14fae61b8d7ebcdd97d3a056f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2644 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2644 AcroRd32.exe
2644 AcroRd32.exe

pid	process
2644	AcroRd32.exe

pid	process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1372 wrote to memory of 2620	1372	cmd.exe	rundll32.exe
PID 1372 wrote to memory of 2620	1372	cmd.exe	rundll32.exe
PID 1372 wrote to memory of 2620	1372	cmd.exe	rundll32.exe
PID 2620 wrote to memory of 2644	2620	rundll32.exe	AcroRd32.exe
PID 2620 wrote to memory of 2644	2620	rundll32.exe	AcroRd32.exe
PID 2620 wrote to memory of 2644	2620	rundll32.exe	AcroRd32.exe
PID 2620 wrote to memory of 2644	2620	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\deleteServers.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1372

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\deleteServers.cpython-310.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2620

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\deleteServers.cpython-310.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2644

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
19be3806bf3d55a4bc38635b582da4cb

SHA1
fec2f71154f06974079296dc05998c6c8f7f3904

SHA256
a45f8afa925384740c0cf8a3e983adc441edae527eb98e8f8d14d80b82b4e873

SHA512
2941a7d2b0b28e13f32fbf5c3da7391a0a032a11260984b1be96259c4373e9d0eeb3d05d1aabdca8fde94609319ee53f3deab6b530cb8e8a15890bb57d498cba

Download Submit