faad96bbcc51f115c9edd691785d1309e7663b67dcfcf7c11515c3d28c9c0f1f

Analysis

max time kernel
240s
max time network
290s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MinGW64/bin/lib/encodings/cp1006.py
Size

13KB
MD5

b883e4919f142eb82142d1c6e87af719
SHA1

14da6abbac3559bdd3d551c68e73e8c550c980d2
SHA256

a910142d209b1ee807ec1a869444f4339e90fd4b1af54800ed363cbc5925eed6
SHA512

b598c7578be7eb8338257b3ff9e9dcbc14881d339d04da4b015d73a9ef1403a187318e7b1089b310401086c24d2531d2d906b15bd33d8ec518316e3ed66b1119
SSDEEP

384:JBwZimhSehiztf9j1nFzTtfdj1/tv5H1XJftNvZnVXOG9:s1hlhTG9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1760	rundll32.exe
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 1760	596	cmd.exe	29
PID 596 wrote to memory of 1760	596	cmd.exe	29
PID 596 wrote to memory of 1760	596	cmd.exe	29
PID 1760 wrote to memory of 2884	1760	rundll32.exe	31
PID 1760 wrote to memory of 2884	1760	rundll32.exe	31
PID 1760 wrote to memory of 2884	1760	rundll32.exe	31
PID 1760 wrote to memory of 2884	1760	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp1006.py
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp1006.py
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\cp1006.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d1523d02cd457d58b0c0216a25b5df52

SHA1
e1de7b892a9d8bd611b0c9061b7f9c86149d5558

SHA256
d2f753939909f30202d6c4e62275d8fe0c03096cf255c868d94b359da6cfb305

SHA512
37244d31d94e329cc94a24411b57ff3ba12b75e2ed26d469980d9b6b0f7c9721dd7d49c3b9e334cc935469ad2bad91f90d25a365f92a4983d7f1f497a76c5855

Download Submit