faad96bbcc51f115c9edd691785d1309e7663b67dcfcf7c11515c3d28c9c0f1f

Analysis

max time kernel
122s
max time network
131s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MinGW64/bin/lib/encodings/__init__.py
Size

5KB
MD5

72528e689fa5ea33353c20eb4d7ff757
SHA1

324e4ed6991d8e69d5d6e2cd499964729e8d547c
SHA256

aa6898ce3b7bf005a4d7f8e113b557323c8f20219d08f6cae1d94a70fef5a768
SHA512

25bfb241e8fc67db28d7c1ccaade44796b7dfd916472713496eda9c30f29fd496c0a45d9f006426471ebc142359cb8fcf9ce1046e3b82191b8879bf95833042e
SSDEEP

96:VHIYGsplFe06Q0YTfsRtm/6kh8EGHd+mWkJ4q3m0shGZIRAwyAroIEJYh:+YLplmYYK8vzn4q3s0AroIEeh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2716	3060	cmd.exe	29
PID 3060 wrote to memory of 2716	3060	cmd.exe	29
PID 3060 wrote to memory of 2716	3060	cmd.exe	29
PID 2716 wrote to memory of 2600	2716	rundll32.exe	30
PID 2716 wrote to memory of 2600	2716	rundll32.exe	30
PID 2716 wrote to memory of 2600	2716	rundll32.exe	30
PID 2716 wrote to memory of 2600	2716	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\__init__.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\__init__.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MinGW64\bin\lib\encodings\__init__.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b456a70382bc8d192ba124120dac8ecb

SHA1
ac35c8cdaf523e228453072ff1d43c1d53068bc4

SHA256
cfa08591c031f8cba3bf8b3cb2b2c167825d9f6877a0b002225ada59f3e1bab8

SHA512
9198a7a03eca99471ddb4ef29e0b3a4284c313be4c1fc196eeea164eb15db0eaa48dc97050a1d99f51e7f8781cdcbcd5d3825d9bbce308301e08be975c5ca073

Download Submit