cdffbb670c3255ac6adc156a95b3ff5c9e7aa8795898f386a0d6fcc0c9d4518c

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Py-Exe Converter/SpeedGo.py
Size 2KB
Sample240504-znkevaea39
SHA256 312b93f982cc4f4cff53cccfecedad229fb6cd9fa90aeb30e69a51170309ac38
MD5 183c7d65b52a8307dc6318b9daa4ba87
SHA1 acefbd2cefe869b1dcd6540385430bc1574b9cb2
SHA512 baf58eb77b44e5019c2e4e9f7cc5b3111dc5463c37abc763210f289836746470a1657e4cb5d7d5254359dc3849cdf80b5d8bfa7b658bd0673950b87ad1b1ce70
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2576	2388	cmd.exe	29
PID 2388 wrote to memory of 2576	2388	cmd.exe	29
PID 2388 wrote to memory of 2576	2388	cmd.exe	29
PID 2576 wrote to memory of 2796	2576	rundll32.exe	30
PID 2576 wrote to memory of 2796	2576	rundll32.exe	30
PID 2576 wrote to memory of 2796	2576	rundll32.exe	30
PID 2576 wrote to memory of 2796	2576	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\SpeedGo.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\SpeedGo.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\SpeedGo.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 34dea42daedde59f230fb897851310cf42f140372179245b4deb6721aa4ec433
MD5 fbb9aa61b485a57a94d4109fa5a5722a
SHA1 78d39bc4c50b661507b356b5a235c87e8d46e6d6
SHA512 deb30d2ec26dc2e22a14d2eecc4e9b4c0f8b4d6580e199019a42d8d1cb8c181e0d2c511dd760615af3e832a4adae14365db1eb26968e54c6fee81084f3489e2a
MD5 SHA1 SHA512

Submit Download