8fd185a5499d728eef4cd181477b0720a60c8be143ff2628941bb2a5985b1f73

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-04-2024 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windef.pyc
Size

31KB
MD5

5e70eda0de72c5dbbd5ff6a86e2e7694
SHA1

c3da1694c7d63e4d0050a52e21cf99ec064788c9
SHA256

f1dd109b6bdacf0c70c01c2fd0585d624b4d3d707fd9808ceb620a9e0816ba3c
SHA512

f24b6f4687dc2821a8c070f3f792dc1792b7f418d4a49605143de2a291ad6cd946f7ed5c2769020d382da8c388001438d35afdbc8e7d0b0b5be133e6a4870713
SSDEEP

768:Fz9pK3NFSYcccA0Wrb/tReEXmbKdCl6Vzl4ST4hTJEn9U:5UDSAn3DXmbVl6du8MJEnu

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1920 wrote to memory of 2536	1920	cmd.exe	29
PID 1920 wrote to memory of 2536	1920	cmd.exe	29
PID 1920 wrote to memory of 2536	1920	cmd.exe	29
PID 2536 wrote to memory of 2724	2536	rundll32.exe	30
PID 2536 wrote to memory of 2724	2536	rundll32.exe	30
PID 2536 wrote to memory of 2724	2536	rundll32.exe	30
PID 2536 wrote to memory of 2724	2536	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\windef.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\windef.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\windef.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b4ef6e478841ea6d7ada58b1c726ff6c

SHA1
a90dc40b5895cd214b4b6f789b846745c2131a63

SHA256
1d4925c8ca5f57c025e7f7d74882ccc170c0e4da4ab3d73891a06e8fe40df635

SHA512
7c58a578c44c3f17506112c113f08f36b79652b352896318427542d41375f8bec5e6c15ff40364f709d2802a08354d5643f2407fef296c9085f63ed508aa2bb8

Download Submit