26cca1ec09795f47b983d21c69312fefed6cdc8806fbdbbf920b1beee1d442a6

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/03/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xvirus-Tools-main/util/options/token_leaver.py
Size

708B
MD5

d07836dfdae885aa63f2330d77ebd13a
SHA1

7fc41aa969002ad4024c49391e052ebe5bbe4179
SHA256

14af02b6cafe82c28152c6514d7e5fc6684630575d99539a4a8b14e407bd62e6
SHA512

4f050551a0c025432092ffc4d7c6c1a5803a5750cc99a9e393cd88fafa519cfae4ee12b322f7cdd27915f2fad09ff40ec2f9b8571b4c7b8ed307ccc9b130077d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2672	2476	cmd.exe	29
PID 2476 wrote to memory of 2672	2476	cmd.exe	29
PID 2476 wrote to memory of 2672	2476	cmd.exe	29
PID 2672 wrote to memory of 2604	2672	rundll32.exe	30
PID 2672 wrote to memory of 2604	2672	rundll32.exe	30
PID 2672 wrote to memory of 2604	2672	rundll32.exe	30
PID 2672 wrote to memory of 2604	2672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\token_leaver.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\token_leaver.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xvirus-Tools-main\util\options\token_leaver.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5b0959bc55532f0dde371af91cd582eb

SHA1
34b9cc2088724deb5746dee9939899cf42ea18b8

SHA256
0414faf82ac5425ca38e3594f84ddc44f7688daa9568e4607dd173e8b566e0d1

SHA512
c344fa5f1908eb876fe1742894fdd4c3f3e348c3c91cca8880e5a10bcacc58933fa3d22668759590f155e426c7794892dd3c3b76fd4f7122b38e152d2c507761

Download Submit