73844be31e3efa06d5ab2bd9ed56c5e0421ccd1078340539433efcae288827f3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19-04-2024 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VoidNETFree/VoidNET-free.py
Size

5KB
MD5

16475f875c7f4ed14695f5391faa15d9
SHA1

b64555b39f5af802d97b0ce6f355f74955fbc57c
SHA256

6375ef8cb3ae01d101b2be93b8a65bd7c57c648de728323c5ce87b26f2764b39
SHA512

da48367a93b50c038ec65c5bc961ce9b04ad915ce8d70ccb416cd06a0f50862ab997d7bd9b2270c94e6b71219fe699807247c7108a00b39f5ad4b740a2efceb0
SSDEEP

96:1j6e5CbhLIvhHltidc91WV0mya7FeGQ+YZAoUD3jhn:t15CbhLSRll18B5oUD3Fn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2932	2372	cmd.exe	29
PID 2372 wrote to memory of 2932	2372	cmd.exe	29
PID 2372 wrote to memory of 2932	2372	cmd.exe	29
PID 2932 wrote to memory of 2624	2932	rundll32.exe	30
PID 2932 wrote to memory of 2624	2932	rundll32.exe	30
PID 2932 wrote to memory of 2624	2932	rundll32.exe	30
PID 2932 wrote to memory of 2624	2932	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\VoidNETFree\VoidNET-free.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\VoidNETFree\VoidNET-free.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VoidNETFree\VoidNET-free.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a9232842b274fd9b2959d346e09ed22a

SHA1
a49175aa7357bd1087a6fe6b47ad2b42397fdba6

SHA256
61092c9bc4811208a99690e0068679985a996300828a0319c75cd393920b6e49

SHA512
904a37366fc8485ba4e68052eb314bb914f26d25e864b999da97143f89bfc7ac62daafc6b78fba9db9a2d28855dadeac3c95592a81dd5beb36761ee235701774

Download Submit