0ecfa9e9370f383a669aad9db9a28109c24226496b519e7383713c7c1deaf861

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-03-2024 17:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Chronos/src/utils/__pycache__/massDM.cpython-310.pyc
Size

914B
MD5

8b3b5ea437ede5fefa3e0ff8cbeaa811
SHA1

e8c34ef4500e2c8128363bf195fa5c652a341f16
SHA256

32455849619017085174c0c5a4365264b2a1f340cb28870c458df31066dc7177
SHA512

8774c4997eb3fb4fde66d8d00caa354248c5d11fad716a651a95b4b7349cc73c0fb1f161b4aa6dd5173a2d7c89222e2b63e56f2e6cc3680b243baac463a208c0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
2388 AcroRd32.exe

pid	process
2388	AcroRd32.exe

pid	process
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2276 wrote to memory of 2644	2276	cmd.exe	rundll32.exe
PID 2276 wrote to memory of 2644	2276	cmd.exe	rundll32.exe
PID 2276 wrote to memory of 2644	2276	cmd.exe	rundll32.exe
PID 2644 wrote to memory of 2388	2644	rundll32.exe	AcroRd32.exe
PID 2644 wrote to memory of 2388	2644	rundll32.exe	AcroRd32.exe
PID 2644 wrote to memory of 2388	2644	rundll32.exe	AcroRd32.exe
PID 2644 wrote to memory of 2388	2644	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\massDM.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\massDM.cpython-310.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2644

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Chronos\src\utils\__pycache__\massDM.cpython-310.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
53fad49a4bbeadbaa79c6198813c83e5

SHA1
b172dc262441e6861500bb438a6c665e667ebb99

SHA256
33d5597399ee621a76f83aa73933416d99873eac861eba4caa14becd75d117f7

SHA512
000c6767fb827d7bda8a5a986d8cb4b44da0521934472b79466e4b062e1822c2045bdf5ee835c315688d861de2faa7942a2514fc22f3d0fd159a649f893179b4

Download Submit