Analysis
- max time kernel
93s - max time network
203s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system - submitted
15/04/2024, 12:33
Behavioral task
behavioral1
Sample
source_prepared.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
discord_token_grabber.pyc
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
get_cookies.pyc
Resource
win10v2004-20240412-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
misc.pyc
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral5
Sample
passwords_grabber.pyc
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
source_prepared.pyc
Resource
win10v2004-20240412-en
windows10-2004-x64
3 signatures
300 seconds
General
- Target get_cookies.pyc
- Size 9KB
- Sample240415-prhejsgg3x
- SHA256 1078edad1660d103c2135793ea9707e4ef7877fb4be7b87c0e538ed84920212c
- MD5 9bdb8627dc166823e7d60603575b689a
- SHA1 de56b5f8b3e891ad07760544132bd357f1e62368
- SHA512 789d21f744eff44456585fd27cd88a67e26b55ed1a043aa76a4b5e63f7dfad99013ca09b15fabecd041f8d35f8d22502c08efd0bb11d26ca083f02a64eae6d3a
- SSDEEP 192:kNal3eiNis9QfUFoxJvm79F211G67+PtAhN:kJiB2lrj7jKlAhN
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\.pyc\ = "pyc_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\open\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\.pyc OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\edit OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\edit\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\pyc_auto_file\shell\open OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-2288054676-1871194608-3559553667-1000_Classes\Local Settings OpenWith.exe - Opens file in notepad (likely ransom note) 1 IoCs
pid Process 3480 NOTEPAD.EXE - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3560 OpenWith.exe - Suspicious use of SetWindowsHookEx 45 IoCs
pid Process 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe 3560 OpenWith.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3560 wrote to memory of 3480 3560 OpenWith.exe 94 PID 3560 wrote to memory of 3480 3560 OpenWith.exe 94
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc1⤵
- Modifies registry class
PID:3248
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc2⤵
- Opens file in notepad (likely ransom note)
PID:3480
-