460550950795698b91eca429b99fe023999af2edf205d67d6462c190e1f4e6ca

Resubmissions

03/05/2024, 18:40

240503-xa7xwagb26 10

03/05/2024, 18:19

240503-wynngach5t 10

03/05/2024, 15:38

240503-s26fxaad2t 10

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OSbot judicable/_internal/model/near_reality/__init__.py
Size

167B
MD5

9d878b09ce606d2cca769db42351b3c4
SHA1

124db52a9cad916c1f7e6a6b4a986b607298fdc7
SHA256

ea111da18b2790d21dc6d6df77226b599f6e769ff66c45926d53a18a73e2261b
SHA512

667e1e76b2e7894ccedb538df75575c541290f8c1ca7b220f1cc7d259a02790a0c78213b173769f3fccffb79240b1adfb8cc3d35cbddfc92a8dc718dcce65362

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2632	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	AcroRd32.exe
2632	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2620	2340	cmd.exe	29
PID 2340 wrote to memory of 2620	2340	cmd.exe	29
PID 2340 wrote to memory of 2620	2340	cmd.exe	29
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30
PID 2620 wrote to memory of 2632	2620	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\OSbot judicable\_internal\model\near_reality\__init__.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OSbot judicable\_internal\model\near_reality\__init__.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OSbot judicable\_internal\model\near_reality\__init__.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
817c0c94903982bf1e850496cc9f2ba7

SHA1
5531c2425accff4581ab56c80eb814c2ce6a9472

SHA256
75bef09c6b1788c59266073140febd9d4c742c5851b134416c6f4a000fceb3d1

SHA512
d3ee4db8f070d59b9bea3865a494a8d98f8bb1b48abd34b3f095d870d6c7138e1dd9ce3b50e4bf8945971cc62827dd233f7beca435376832dffb369a45b0c3c2

Download Submit