0ecfa9e9370f383a669aad9db9a28109c24226496b519e7383713c7c1deaf861

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
22-03-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chronos/src/utils/__pycache__/leaveServer.cpython-310.pyc
Size

901B
MD5

8c2ff9258497ef7ff6c6194718b510fa
SHA1

64b2ba62b6ad92a455a82fe0b6e870df23765189
SHA256

69b18d523aa9406cfa953d38f03dc16ba88ea8407f1ecfd2852ada0cf23e9403
SHA512

41f7de0c9ba2d7ba5b95d5c00b680a7dcdf818dd84d376df8d956a5d836f6b267ea71491781dde90e1bcc603c09d79f40bdbe72faa991feb7ae7d13e1dc86b8f

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2600 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2600 AcroRd32.exe
2600 AcroRd32.exe

pid	process
2600	AcroRd32.exe

pid	process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 2556	1964	cmd.exe	rundll32.exe
PID 1964 wrote to memory of 2556	1964	cmd.exe	rundll32.exe
PID 1964 wrote to memory of 2556	1964	cmd.exe	rundll32.exe
PID 2556 wrote to memory of 2600	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2600	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2600	2556	rundll32.exe	AcroRd32.exe
PID 2556 wrote to memory of 2600	2556	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\leaveServer.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\leaveServer.cpython-310.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2556

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\leaveServer.cpython-310.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2600

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
942544bc03a7c80ebe0b313ff03ef67a

SHA1
485a1999cdf3172dab12a35669595578f8065b16

SHA256
906c88d5373323ac5ff9ee61f492ca0126e4a7af3ec5238a8c2f414cd260b5db

SHA512
3677200afa55f55501dbfe5fa5b4b360793d7d1a2785e07d37691004a371923abf7953cf0de270dcd3bd7a64e1cf72d1d812c1a03d9e52a39824ab8d40eee88a

Download Submit