6995e33cf3c6078ad21fa9f5dccb03cc8a12a27953768cf85ecab1ddce1852a7

Resubmissions

03/05/2024, 20:03

240503-ysqa8aeb6z 10

Analysis

max time kernel
1563s
max time network
1571s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/05/2024, 20:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

depot_228990/MFGW.app/Contents/Resources/lib/python3.9/copy.pyc
Size

6KB
MD5

feb42fec2628bd3413181c1fafa49190
SHA1

f8b595c56c6ad6fadf4b2beab50ac7afa4268364
SHA256

ab6e215f5fdb0f3d7be3a334ff236c3e60c8f59dc751dddd246c598fad72d5e6
SHA512

a6aef0daabac6a38f58f528418890513051831711b0893905255b21d77b6b54ecd535a76a6e7a608d9d3006539fef3913e44509d77a0d5acf1244ff0c78423ae
SSDEEP

192:4zPakDZxS5GaHl1isTKOuyDqAzJ2yvqejQdqZA/8cZfMgwi:Ea0/S5G0V2IGGn/cdcArf9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 2564	2032	cmd.exe	29
PID 2032 wrote to memory of 2564	2032	cmd.exe	29
PID 2032 wrote to memory of 2564	2032	cmd.exe	29
PID 2564 wrote to memory of 2084	2564	rundll32.exe	30
PID 2564 wrote to memory of 2084	2564	rundll32.exe	30
PID 2564 wrote to memory of 2084	2564	rundll32.exe	30
PID 2564 wrote to memory of 2084	2564	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\depot_228990\MFGW.app\Contents\Resources\lib\python3.9\copy.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\depot_228990\MFGW.app\Contents\Resources\lib\python3.9\copy.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\depot_228990\MFGW.app\Contents\Resources\lib\python3.9\copy.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1bdf9c7315a7a5286c8a38031b09623b

SHA1
400d1198d60ef31137b6c448126bf37d3acc4cb4

SHA256
6d12ee0d89f33c6099c5b677163fd389c0efc2e90a862a8e2b49f1e74a0b4101

SHA512
d151d88bad8f0bacf7f18e0c7e50e37ea1602722a0073cd00470e3bc65310032d786b98574ad97d4f572e2d4694fe3eec37ad6a89ec974b30c53db6e319f7531

Download Submit