bef59b9a3e00a14956e0cd4a1f3e7524448cbe5d3cc1295d95a15b83a3579c59

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 04:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TsHi.pyc
Size

10KB
MD5

27c69aa39024d21ea109cc9c9d944a04
SHA1

66d39af5d61507cf7ea29e4b213f8d7dc9598bed
SHA256

758598370c3b84c6fbb452e3d7119f700f970ed566171e879d3cb41102154272
SHA512

970f9cf48ab55f8e45d2d7448e71bbf58d3104c7e8a7379977e73807c809dd8099075c6a83abfffb2d684770186133778e00e10a9b717a71218d4e7c17fe9a07
SSDEEP

192:Q2bVZKjrQyOmaNJ5zYzz3OXfSYKNuZOIVvcU8GwjSdPd3LDvMVaSeaqnQK:PbjWDmJ5B04ZOyvUGdGVaSeaCQK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2432	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2432	AcroRd32.exe
2432	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 1972 wrote to memory of 2340	1972	cmd.exe	29
PID 2340 wrote to memory of 2432	2340	rundll32.exe	30
PID 2340 wrote to memory of 2432	2340	rundll32.exe	30
PID 2340 wrote to memory of 2432	2340	rundll32.exe	30
PID 2340 wrote to memory of 2432	2340	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\TsHi.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TsHi.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TsHi.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
50ddd9956c0560c8b1a6172ea7304a32

SHA1
fbc5d4b3d6a9b4ac942f8ee6ab67b6d27b97ffbe

SHA256
c717ca0e5115b8ccda4b347ba6bcfa502b08a47aaa676cd8d2fd6332b715b52c

SHA512
0d533b66a9d32116bf2a9d49a18c4439f7190ca2ee42cb62a39d92cc7dea6a1f287a02db43acf0add69e5997baf766b8d84bf11a0ae69a271e5dd3c073c8c648

Download Submit