b2a87d283c61c661f5f3b28dbaf9f4f2a624097d0a94895adbfb576a54c14ac0

Analysis

max time kernel
1560s
max time network
1561s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/03/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

we-to-lively-main/main.py
Size

7KB
MD5

0f86b5e503366b6fd4ae83337766f638
SHA1

fd7877dc1d4e7cb724e7bd17befd7159098b2286
SHA256

fa1a87c486891884409be17baf8f18e557e0704cacb008f04edb8e9c8587406f
SHA512

8d5ac57b00b92d934e917bf9012d17f5d490505f4a1f298259353c0d298d4723a17f46b4d76e2645f3a0bb2f4b1d033493408ce5878a99372b7e8a9e50f0cf6d
SSDEEP

192:sbIZUJvVSx/x6L3DV/ISADV/Z/pEOuHD9:sfSOmxaND9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2652	1700	cmd.exe	29
PID 1700 wrote to memory of 2652	1700	cmd.exe	29
PID 1700 wrote to memory of 2652	1700	cmd.exe	29
PID 2652 wrote to memory of 2816	2652	rundll32.exe	30
PID 2652 wrote to memory of 2816	2652	rundll32.exe	30
PID 2652 wrote to memory of 2816	2652	rundll32.exe	30
PID 2652 wrote to memory of 2816	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\we-to-lively-main\main.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\we-to-lively-main\main.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\we-to-lively-main\main.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f1c22ac741916bc538075a81b986708

SHA1
bfba2220be5bdd7896b8c330108a353b0ae77379

SHA256
61ea46911ed00a44b692d952289cf592614c2c8473c12d252616a94c0ebda5b5

SHA512
15fd631fac54ad28e8040a092374aeb1b540cdc9298798c30800b0feff0f6b8a6d7b32a660ea82244eaaaba2c75145cdd0d26b5db682c907b0323fad28e50291

Download Submit