7aa64aad2b06dfed71dca4bcd403d9fe8e1a6d12b10a05eee75d8c00afb1fe63

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
07-04-2024 08:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

z.py
Size

944B
MD5

53208bd6bf45b2bab3cd17d972b7bcc0
SHA1

5b269abcb7f3ff5306517bc16bd0cdb9e4159837
SHA256

7aa64aad2b06dfed71dca4bcd403d9fe8e1a6d12b10a05eee75d8c00afb1fe63
SHA512

426398bff0cd9d34656cdede15b251ca1d5bf3a9b110cf35f7395f81bc4b2bda42e04667d008e2164d1c6709fd1ebfec95570211d55b1b5d93e8e74e3a13b236

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2610426812-2871295383-373749122-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2392	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2392	AcroRd32.exe
2392	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2592	2188	cmd.exe	29
PID 2188 wrote to memory of 2592	2188	cmd.exe	29
PID 2188 wrote to memory of 2592	2188	cmd.exe	29
PID 2592 wrote to memory of 2392	2592	rundll32.exe	30
PID 2592 wrote to memory of 2392	2592	rundll32.exe	30
PID 2592 wrote to memory of 2392	2592	rundll32.exe	30
PID 2592 wrote to memory of 2392	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\z.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\z.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\z.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
29b096f4b232d6aec0575233fda12951

SHA1
4c25ba66af4f2ca8df8d347e57bb4457bf156a4e

SHA256
42e30ba66b4c8a8526265acc01347f60a0b0e0bf063e21925059a2a6869c13ff

SHA512
be62d37b19bd022f0687265e1bbb368531e9a4767149002986ef7cdda47a5d596f2abfe9e4583ccb282d70e46b3186a6edf81b2ac7715acea18d1911b4af24de

Download Submit