a73f041afa6413f0fd67e9672bc4b956c9be1ca2f4de3bcf6455d5e0d3c67b89

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cryptic tool/util/14_AutoLogin/autologin.py
Size

1KB
MD5

288c0a17d9aa192123401afe0a99ebec
SHA1

2d1db5d93cd13d6d795ecc69764557e488035f92
SHA256

fa44f2c3332ee95e44ee00c5793c12be831a0cf0f423d407d89648f92cfe3c38
SHA512

9fa942eb990727bc87c673360c36e73b5fe82ad2c7f6aaa5555528cefe87f3bad90f176348ab0f27532377358dd3063ae7d9be273f5775a28957cb6340cf9923

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2500	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2500	AcroRd32.exe
2500	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2696	1760	cmd.exe	29
PID 1760 wrote to memory of 2696	1760	cmd.exe	29
PID 1760 wrote to memory of 2696	1760	cmd.exe	29
PID 2696 wrote to memory of 2500	2696	rundll32.exe	30
PID 2696 wrote to memory of 2500	2696	rundll32.exe	30
PID 2696 wrote to memory of 2500	2696	rundll32.exe	30
PID 2696 wrote to memory of 2500	2696	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\cryptic tool\util\14_AutoLogin\autologin.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cryptic tool\util\14_AutoLogin\autologin.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cryptic tool\util\14_AutoLogin\autologin.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9a0101cbd666e850894af987f92daf90

SHA1
f73f310de7844cb8780650e21e2632bf25b63ec5

SHA256
880fb518fe64d0c9756bcfad1c4a25225e3e3de387cb016d14431e2f71a55f25

SHA512
457b3eae3e5b74089ced395c228c03a3454a1e51dcc40cc622476ad483a9a03e5f26f7e065574000bd230362f0e12c081c5bd6c3abd3faa19fa1c0874a8659e7

Download Submit