Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 22:52
Behavioral task
behavioral1
Sample
massdm_1.exe
Resource
win7-20240221-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
massdm_1.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
massdm.pyc
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
massdm.pyc
Resource
win10v2004-20240508-en
4 signatures
150 seconds
General
-
Target
massdm.pyc
-
Size
1023B
-
MD5
2fecf336a96e83cf3f00e15e49cef8eb
-
SHA1
0a2086885d43b3a06fcaefdeebdc40f0776c42ea
-
SHA256
13888a91a665df05df33bcc8c4b333cd4d54bd6c1e1cfd9d05c8a799ea331517
-
SHA512
504691d0183ee8c03f0f4cde538df3a7cb2d6e29094fe1b01bc9a17dea98363f81648cd5559bbb9837819d19b611ad3fd0c982cfe47492b96fe76d71f030141f
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 840 wrote to memory of 2644 840 cmd.exe 29 PID 840 wrote to memory of 2644 840 cmd.exe 29 PID 840 wrote to memory of 2644 840 cmd.exe 29
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\massdm.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\massdm.pyc2⤵
- Modifies registry class
PID:2644
-