faad96bbcc51f115c9edd691785d1309e7663b67dcfcf7c11515c3d28c9c0f1f

Analysis

max time kernel
120s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MinGW64/bin/lib/encodings/cp037.py
Size

13KB
MD5

4fbf9df02a61a5274d589bf04f102925
SHA1

02493d061cf632eed33453ba0f04795e857d1741
SHA256

8290a19a8a2fb70a95aeb4650cc85a46660fa624b7110abd0f130b69b9781cc8
SHA512

514c0e83eee84c9a62090e4bf81da9c48117993e1d0ae5bd23494f53f0a012bd3a90069337d17c02d56889053973caa148017a81cfbab4b9fb77b62806536d42
SSDEEP

192:HnM5uEBDUtKvJgARQ+3/alt3kXX5SES9Otn2AY:+Bm+3//JSES9OUAY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 2476	1028	cmd.exe	29
PID 1028 wrote to memory of 2476	1028	cmd.exe	29
PID 1028 wrote to memory of 2476	1028	cmd.exe	29
PID 2476 wrote to memory of 2680	2476	rundll32.exe	30
PID 2476 wrote to memory of 2680	2476	rundll32.exe	30
PID 2476 wrote to memory of 2680	2476	rundll32.exe	30
PID 2476 wrote to memory of 2680	2476	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp037.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp037.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp037.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
65c6c3e6354ce289f0fbc571b4d071e1

SHA1
0edfecf3a3e007ab60e8c764bd7b74896bc30418

SHA256
24e3a0e05980f3cb174dc3dcfb53a452cf9504749bbd85ac324ecc4b981e7fe7

SHA512
c9db9860d3bf0490f11e7fd30c3a9911e1182ea6852f11705b8a9bd3f0077b4adee6d7a5fb3c08178dd5eb8717c895961f7d98ca385d91a1d8ff7200bb59c381

Download Submit