460550950795698b91eca429b99fe023999af2edf205d67d6462c190e1f4e6ca

Resubmissions

03/05/2024, 18:40

240503-xa7xwagb26 10

03/05/2024, 18:19

240503-wynngach5t 10

03/05/2024, 15:38

240503-s26fxaad2t 10

Analysis

max time kernel
133s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 18:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

OSBC.pyc
Size

8KB
MD5

841437319f7c62d64daedd2eecee339e
SHA1

7fa7cdccb82864f0a237294df9eff9871ccf2a26
SHA256

4bb5d50dfe5d05456aa94206c226d1b6c31392a1de2da84bb84feed175f48cce
SHA512

82972afd227779cf04c96d74ba7fd016f5d85d8cdd8ce01ba1f86349f74b4dd1a490a4527b170db59a90262ae1b38f780353278cfc3509b82ce230625237c52f
SSDEEP

192:1jz3oLX+DdZuMbV7Q5Jz6MEm+zymuzugcC3W3wP:Nz3oOQzzammcc+W3wP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2700	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2700	AcroRd32.exe
2700	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2676	2148	cmd.exe	29
PID 2148 wrote to memory of 2676	2148	cmd.exe	29
PID 2148 wrote to memory of 2676	2148	cmd.exe	29
PID 2676 wrote to memory of 2700	2676	rundll32.exe	30
PID 2676 wrote to memory of 2700	2676	rundll32.exe	30
PID 2676 wrote to memory of 2700	2676	rundll32.exe	30
PID 2676 wrote to memory of 2700	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\OSBC.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\OSBC.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\OSBC.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
06cb51033a3da2dec70a6663a7f9bbca

SHA1
cea04384432c883b2898245180f69221881d2586

SHA256
1c4dbabf0c00d75383eee719c9f2e65e1cc84ec8cb2fd847b79a828678e9811b

SHA512
760a3a01657395140ff38025b7a00a96a8f16d11457db4fe80bae07ef1c29403f5b2c46fda65b684bd8a68cbe517cf7eba6af9ca3e6b4ecea208b3eca2d51ce6

Download Submit