98b52813707d4293c6150cd7e602240ad1ca266807c3c7225f2a3dbf6de7a13d

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
09/04/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

MerekV3.08 Lite/Merek Aimbot/__pycache__/keyauth.cpython-310.pyc
Size

19KB
MD5

03913d5dcd09637c06deba35d3cf8ab6
SHA1

3c49ea419bcd02e50a5102e60387d09a079b7d57
SHA256

f97e0981bbfec62065e9101300ab345f2389c6b94606a2ea655b8c38e11aa575
SHA512

8be7da1ba56dd7b2e62e7f4db6d96fa0ac04bcddb231c36a79d3cdf55a5af5f5808b1604ee5552943665cb39298fc1f9c163f796284c8268606a8782f688a8ba
SSDEEP

384:8PZGJybYD3edL4xzhmp2Ugcem86Rv+dxbpqYSLDYmG0iLnOVy:qjNk7mp2GeX6RvKbpqYSAmH0nCy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 3060	2184	cmd.exe	29
PID 2184 wrote to memory of 3060	2184	cmd.exe	29
PID 2184 wrote to memory of 3060	2184	cmd.exe	29
PID 3060 wrote to memory of 2584	3060	rundll32.exe	30
PID 3060 wrote to memory of 2584	3060	rundll32.exe	30
PID 3060 wrote to memory of 2584	3060	rundll32.exe	30
PID 3060 wrote to memory of 2584	3060	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MerekV3.08 Lite\Merek Aimbot\__pycache__\keyauth.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c1e54a2da6dd14920dd5a14402ed995f

SHA1
366bb363b9f7c668bfe060c97f4f8440ad01c3fb

SHA256
c25f32ce28d1888058ea66bceb0be9d44ca3ca7f24324e1e6f677e5e5fdce014

SHA512
fa035bc0c8a32785f3ca27390d8c9698a56500b9a6d7d8a85375522bfd7c0a7bdd071d3deeb47436f68b92b120e572a1981b7f927e456c86f0762051f22f5715

Download Submit