cdffbb670c3255ac6adc156a95b3ff5c9e7aa8795898f386a0d6fcc0c9d4518c

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Py-Exe Converter/venv/Lib/site-packages/pip-19.0.3-py3.7.egg/pip/_internal/cli/autocompletion.py
Size 5KB
Sample240504-znkevaea39
SHA256 a6dbec31d1a3ab8da9ce8638b24001545e37bb6c40b4b2655c0ba53e2f80d746
MD5 e9d4bf272f73a236d61c878f82410d64
SHA1 815f8798d6ef7aefd1ccad2892b58946d7fa83c2
SHA512 4747befc1d90268b11e7317bd3d97874cc5b90f408d1fe1d96743fb523cd0b63d3c495b3f5f715d0bf8f4807aaaa1fbc446ef98f2ff8ffc563a66a21fb583b08
SSDEEP 96:sVIhbddq2B/vc4pAMJmLwtjpWW/lcd96U1WRXb:KsbddXnpOwcd9T1WRXb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2696	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2696	AcroRd32.exe
2696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2092	1884	cmd.exe	29
PID 1884 wrote to memory of 2092	1884	cmd.exe	29
PID 1884 wrote to memory of 2092	1884	cmd.exe	29
PID 2092 wrote to memory of 2696	2092	rundll32.exe	30
PID 2092 wrote to memory of 2696	2092	rundll32.exe	30
PID 2092 wrote to memory of 2696	2092	rundll32.exe	30
PID 2092 wrote to memory of 2696	2092	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\_internal\cli\autocompletion.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\_internal\cli\autocompletion.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2092
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\venv\Lib\site-packages\pip-19.0.3-py3.7.egg\pip\_internal\cli\autocompletion.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 0f0b98a17c5826bf51ee86aa45bc4bac8f6baa941591cbbdbd15dc00a25d3efb
MD5 cce62373dc18f7399e57f7b16cfaf886
SHA1 7758906fa9bc978a3dcbb200c9737920ac1be466
SHA512 318cbd3349e820733c3c5751c768204a881e7c67106df004c83977fad70bdb96d4b4f40b2e8f05bf47c0c9d254aa9be68073bb258ef0af7016ef7be693100ce0
MD5 SHA1 SHA512

Submit Download