9a22730e51b8ca430a9cab0a339ae192ee4c1698ac07819396fd0e7e2666d466

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
28-03-2024 05:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

T0kenCreator-main/creator/client.py
Size

11KB
MD5

bfe6efeaa27498a3d3177b5c9f7e3887
SHA1

2282d3fa7ac6d25a124d612d704aa3a5bd6f553e
SHA256

3f5d91aa4aa7ed756b1c6fde48e3b7330561360aec818208b1508882556fa4d0
SHA512

2005fe13daa87c108eb725800df629f91018594fef62c0b04ff649e8d1cca347882d2bd2c897bd920299d3293c789230e4eff9e4be7009fe69906cc029e652fc
SSDEEP

192:REfSKUAUWOwsHVotwukSs3PxAt2Z0JNCT6AhT07s8j2AvoYn6sjpMr4GI+DUQA8:RE6vHWOwsHat6Ss35At2ZzTjhTF8j2AU

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2540	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2540	AcroRd32.exe
2540	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2352 wrote to memory of 2576	2352	cmd.exe	30
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31
PID 2576 wrote to memory of 2540	2576	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\T0kenCreator-main\creator\client.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\T0kenCreator-main\creator\client.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\T0kenCreator-main\creator\client.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d66c40b0c2277c55f929ee412284ee9d

SHA1
8d90f08def19de0a3e9f1135e8767070f461221f

SHA256
ffbd53b08ee8a49ecf84166098dd4abe4f00cc1c198746d7e5c07bc8450b0ec2

SHA512
1b8a103a1b5055e28d461e781c99ca7255dbefdb04489563f411c82415230614259cdefde72677caf5d3febe78759078fd1c2d2f7dd8db68c8ee3c2af51fdc32

Download Submit