d9c6ba096bc85554d5e3adff83edb5c97c179bd28f21bff3c4969786be9daa36

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/04/2024, 22:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

koalahook-main/koalahook.py
Size

11KB
MD5

119bcef66ce9ecfdd53d29fe61d7d57a
SHA1

61adb83679b95f8b8093f8e6132d5d725919f4b4
SHA256

83a757a698e7e478d67365af75781af1cea336cdfbea7026fba6183b6e8906ea
SHA512

830045c85e2df03809c140ce78874ced5e1bbc13c9d6d4f4881b3243b7d6480b78148eceb7d9a6e47ec9bb8b614a3f4ec8c59d6421337e21f028d1d7d4f7a0f2
SSDEEP

192:dMiNyNADAnFcaA8AcTg/TYGQIiRw+Z+Y+Y+U1aXeFNDtIrmNtn:dHoAD2maA81Tg/TYGRiRw+IY+G1tFh1F

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2340	AcroRd32.exe
2340	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2540	1692	cmd.exe	29
PID 1692 wrote to memory of 2540	1692	cmd.exe	29
PID 1692 wrote to memory of 2540	1692	cmd.exe	29
PID 2540 wrote to memory of 2340	2540	rundll32.exe	30
PID 2540 wrote to memory of 2340	2540	rundll32.exe	30
PID 2540 wrote to memory of 2340	2540	rundll32.exe	30
PID 2540 wrote to memory of 2340	2540	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\koalahook-main\koalahook.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\koalahook-main\koalahook.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\koalahook-main\koalahook.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
021591dea7ae1f389344b092b20c22f1

SHA1
45acb426c8957a7b1d62fea8a29b6461b51bae08

SHA256
4c73b9c0cccdc0e2aeb2bb766b5ce6f019affbce25cbb6b59470aa20bb3f61b2

SHA512
3f8696af6b127094427333ef80bb41dec31b8fe56765ed8f8eee6cbd8186337cb3f2cc5bf91da0114543125b286e30507b5aed515f587bddaa091fafe204bd36

Download Submit