d1e70155a0fe1b2fa003997448f63f865fc9b3a6b3071ba91e09ce39fee7d5ba

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 23:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tears.pyc
Size

61KB
MD5

3a4927909a671a6792926fa5f3841c4e
SHA1

28b517b8f63c2f2b5b4330724cb01a2abf1fe126
SHA256

037769954da26da1a8b9ca91982471d84382be3608628e74bd6633717af8c6eb
SHA512

7bdeb9fb0f11139d9a67c753a0ca322e857ce4f876ff2761aace2c5b2084d171d928493834387c2818dce12624c61f00fd849914c88f1112903222519c4713df
SSDEEP

768:iANZ4t/Wpuem0hVCZvxzsGW/fYkLUG66/wpjxdJ+Fb4DT:iOJmDdC8aFoT

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\pyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1352	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1352	AcroRd32.exe
1352	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2664	2904	cmd.exe	29
PID 2904 wrote to memory of 2664	2904	cmd.exe	29
PID 2904 wrote to memory of 2664	2904	cmd.exe	29
PID 2664 wrote to memory of 1352	2664	rundll32.exe	30
PID 2664 wrote to memory of 1352	2664	rundll32.exe	30
PID 2664 wrote to memory of 1352	2664	rundll32.exe	30
PID 2664 wrote to memory of 1352	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\tears.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tears.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tears.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
847d76c9b7c5137c6dc8dfea28142f55

SHA1
bc22329a8f1cc05adac66e9f467f249c445dff5c

SHA256
22994a64ba1af4d02ac587c3eb95afe9e5f531e688dfa60a6f8dbf8f11815349

SHA512
363ef9b1f710debcbf759bf4f19202bc29b50de35b78838df0533fafc0afb50707da1f1b4d0a1aa7fe637f7db6c19cd24a1ca252fada69eeab42d364e3e35692

Download Submit