5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
23-04-2024 03:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ftpcrack.pyc
Size

31KB
MD5

cdfaeec3b576ee1e801ed0d7981729e9
SHA1

d7e34e25732b9e9cf422c5921148e09911c206ec
SHA256

153999f48813eed1190adfb2ddf51b73a457ea92563bd54d87aee6220f148cbc
SHA512

250b687d2a263bf5c2defa9d57949a0dcf7c8c685836bd064bdb27ef2382b1ed570c7184588d7349b42f89616f2be4631dcca0778772dc23b149036d5bd122ec
SSDEEP

768:vJu4RMyRk49Ov7Q0iqhtzZlryou6KGxgP7flAoMT5Kzc5e9DPe7:vJu49Rjg7FiqnZlryoXhuP7lAFlKQeVC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2464	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2464	AcroRd32.exe
2464	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2652	2008	cmd.exe	29
PID 2008 wrote to memory of 2652	2008	cmd.exe	29
PID 2008 wrote to memory of 2652	2008	cmd.exe	29
PID 2652 wrote to memory of 2464	2652	rundll32.exe	30
PID 2652 wrote to memory of 2464	2652	rundll32.exe	30
PID 2652 wrote to memory of 2464	2652	rundll32.exe	30
PID 2652 wrote to memory of 2464	2652	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ftpcrack.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ftpcrack.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ftpcrack.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
14268760f1f98a8b5f43c7daeba89c04

SHA1
f016ba5b56cce70e603ae57bf9de3e57c3a3b2db

SHA256
ed4e0eb905c78e663b54f91f045bfe4d94c9e68609c6cd3a9c10a9ebceb3e186

SHA512
b4a1f1e14dbcb69b567fb19b70cb6df75da04807562de01780e05bdf35bde23068975d48c4b1674c735e4d1cb5e77bd37e2ef76ce2bbd0e875edc020ca781124

Download Submit