Overview
overview
3Static
static
1CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...sample
windows7-x64
3CVE-2023-3...oit.py
windows7-x64
3CVE-2023-3...pt.bat
windows7-x64
1Analysis
-
max time kernel
18s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
08-05-2024 08:58
Static task
static1
Behavioral task
behavioral1
Sample
CVE-2023-38831/.git/hooks/applypatch-msg.sample
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
CVE-2023-38831/.git/hooks/commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral3
Sample
CVE-2023-38831/.git/hooks/fsmonitor-watchman.sample
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
CVE-2023-38831/.git/hooks/post-update.sample
Resource
win7-20240220-en
Behavioral task
behavioral5
Sample
CVE-2023-38831/.git/hooks/pre-applypatch.sample
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
CVE-2023-38831/.git/hooks/pre-commit.sample
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
CVE-2023-38831/.git/hooks/pre-merge-commit.sample
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
CVE-2023-38831/.git/hooks/pre-push.sample
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
CVE-2023-38831/.git/hooks/pre-rebase.sample
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
CVE-2023-38831/.git/hooks/pre-receive.sample
Resource
win7-20240215-en
Behavioral task
behavioral11
Sample
CVE-2023-38831/.git/hooks/prepare-commit-msg.sample
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
CVE-2023-38831/.git/hooks/push-to-checkout.sample
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
CVE-2023-38831/.git/hooks/update.sample
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
CVE-2023-38831/exploit.py
Resource
win7-20231129-en
Behavioral task
behavioral15
Sample
CVE-2023-38831/script.bat
Resource
win7-20240220-en
General
-
Target
CVE-2023-38831/exploit.py
-
Size
1KB
-
MD5
f04c728b8304521ee88ccea1bb8ddd54
-
SHA1
27ce9463a35d9fb4c3d11a1b56c7d4bbcda37e83
-
SHA256
2345ee5f0641c8fe1e0eff9b684336e65fdafb9b6ef5b21f343a04980e7e40bf
-
SHA512
22ef36af6717bd89b6541a0c1411106923095b620023e9b4ea999986bf4da3fe4098fc3341d6c64e7d42f4039f5eb77fa0da128eac4d1a813bd19694956c1a52
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2688 AcroRd32.exe 2688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 624 wrote to memory of 2544 624 cmd.exe rundll32.exe PID 624 wrote to memory of 2544 624 cmd.exe rundll32.exe PID 624 wrote to memory of 2544 624 cmd.exe rundll32.exe PID 2544 wrote to memory of 2688 2544 rundll32.exe AcroRd32.exe PID 2544 wrote to memory of 2688 2544 rundll32.exe AcroRd32.exe PID 2544 wrote to memory of 2688 2544 rundll32.exe AcroRd32.exe PID 2544 wrote to memory of 2688 2544 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\exploit.py1⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\exploit.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CVE-2023-38831\exploit.py"3⤵
- Suspicious use of SetWindowsHookEx
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD58b1d44d3b5e7978e029299a31d620385
SHA12673730bcf382a5084702d97cb0d1d5053c90bb6
SHA256633f884c1a45e7bf1219a955b99d44cb598d310cdd8e3d6ab4786697aa727beb
SHA51230486caaab0037d0dac17632a4467ed40380c53a59224387d98674da450337571a9b747cc0fde5004ce6c730fd31343349074accac7650e4a56e332093b0cbac