cdffbb670c3255ac6adc156a95b3ff5c9e7aa8795898f386a0d6fcc0c9d4518c

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 20:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Py-Exe Converter/__pycache__/Main.cpython-37.pyc
Size 3KB
Sample240504-znkevaea39
SHA256 93168220c94076fd2bae5601099b0fc09acf555f50142df77d20dba569fe1182
MD5 a2d4c3bef392f2d4489c2d9bd84e00fc
SHA1 753026743537b76608eb5d2602052a1264771fb7
SHA512 4768c050e98fc333376bcc2c7f78159e241f49bef348c210c6d6c833185906ac21e2f4d801b752b92ca5f7ca55a2f0cf46d20ceba9a905379e49a2a7c2404c48
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2100	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2100	AcroRd32.exe
2100	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 2544	1520	cmd.exe	29
PID 1520 wrote to memory of 2544	1520	cmd.exe	29
PID 1520 wrote to memory of 2544	1520	cmd.exe	29
PID 2544 wrote to memory of 2100	2544	rundll32.exe	30
PID 2544 wrote to memory of 2100	2544	rundll32.exe	30
PID 2544 wrote to memory of 2100	2544	rundll32.exe	30
PID 2544 wrote to memory of 2100	2544	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\__pycache__\Main.cpython-37.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\__pycache__\Main.cpython-37.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Py-Exe Converter\__pycache__\Main.cpython-37.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 c0bb6a3bd662266fb850aef9fde25926b647b320fc1b457a2fa902bf1566b721
MD5 e5c26adeb52c271b870b4984f58f8ee8
SHA1 490bf8d1f0b01a98e4d47467fdfb805f28060842
SHA512 2ade517c41c9f7c7d52cdec38df228f29dd255270afaf2d3882dce3164a0bfed3722cfc3ce622ebab22b1f9815903967233e44579d7e679f03bd707e0a2efa83
MD5 SHA1 SHA512

Submit Download