7aa64aad2b06dfed71dca4bcd403d9fe8e1a6d12b10a05eee75d8c00afb1fe63

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 07:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z.py
Size

944B
MD5

53208bd6bf45b2bab3cd17d972b7bcc0
SHA1

5b269abcb7f3ff5306517bc16bd0cdb9e4159837
SHA256

7aa64aad2b06dfed71dca4bcd403d9fe8e1a6d12b10a05eee75d8c00afb1fe63
SHA512

426398bff0cd9d34656cdede15b251ca1d5bf3a9b110cf35f7395f81bc4b2bda42e04667d008e2164d1c6709fd1ebfec95570211d55b1b5d93e8e74e3a13b236

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2964	2252	cmd.exe	29
PID 2252 wrote to memory of 2964	2252	cmd.exe	29
PID 2252 wrote to memory of 2964	2252	cmd.exe	29
PID 2964 wrote to memory of 2432	2964	rundll32.exe	30
PID 2964 wrote to memory of 2432	2964	rundll32.exe	30
PID 2964 wrote to memory of 2432	2964	rundll32.exe	30
PID 2964 wrote to memory of 2432	2964	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\z.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\z.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\z.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fa836fd4e89f804ea430d35c50515c18

SHA1
91d8c4e5136dee9e6fe1dc6b2d23de5b0ac07cea

SHA256
5ea2c5d3bd3ee2b947ca16c228ed286962747eb1ef18474b2ddad329ada65083

SHA512
30130d479d7a9511733c5e6f074461865f2c0efbdc2953577d447887187b9cb3729e3b0f7aeea2a222e08266a12ca51327c8714d8545949dba69511d9a354b8d

Download Submit