cdffbb670c3255ac6adc156a95b3ff5c9e7aa8795898f386a0d6fcc0c9d4518c

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Py-Exe Converter/venv/Lib/site-packages/pip-19.0.3-py3.7.egg/pip/__main__.py
Size 623B
Sample240504-znkevaea39
SHA256 2f7207a8179ab042d41efc32e424ff8b3544321335dadbdedbcf6abade3d0ef5
MD5 be3f2c8577fe7ff21465a3ae782045d7
SHA1 f49005b194f8ef2418c8e03fc51e5e8ac64a0cfb
SHA512 faee0c4d2d64724b4c5bf572dff72c885adb9dc9d6c7c4568ac697c231ff979ee93449a739c0a72f1f5f09c07aaac7149123db126cb5849482faf14cb4d4508b
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2484	AcroRd32.exe
2484	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\__main__.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\__main__.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\__main__.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 25107ae5849f4ecd23e3d17f21404c2dfe36f9e1cd691d0ec11bb627c2733e43
MD5 3133e772b25816fa755b4eaad06e7973
SHA1 282cbe694e7bc00b8733e4afc1e64e40dd2a7c82
SHA512 17da7e5853ebf9ede925bdca6f8f3f11753df2589853e1993cd43cbf3c84a1d8c194e85317eea9d42f9e3cd87c981d7870bc61e2510fe29ba78a3f8efc8c1fa4
MD5 SHA1 SHA512

Submit Download