9d1d18f2ac55866affbe9d63cff31e07785fb104b93b5a754a53c7f123a2f38b

Analysis

max time kernel
119s
max time network
136s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
12/05/2024, 10:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PoseTheCharactersBody/images/camera_anim_pose_01/__pycache__/file_name_convert.cpython-36.pyc
Size

971B
MD5

16c1a143cb4a0d22b897919ab1a31e54
SHA1

6fd3fbbdb289902bd2af74dedf209728abb4948b
SHA256

abf003e2f00d1b53b0f1b2a332f9aaf49f173a3081520568ce683831ef97fb6e
SHA512

af648e06c872a60b15d1c55da2638eac6beb042d9210d6367132d0cda7d0f6eb4728f13096558347ec6b48c5e961359b70fabfd3c12f9af50a774aed89bcf5de

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2440	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2440	AcroRd32.exe
2440	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2536	2972	cmd.exe	29
PID 2972 wrote to memory of 2536	2972	cmd.exe	29
PID 2972 wrote to memory of 2536	2972	cmd.exe	29
PID 2536 wrote to memory of 2440	2536	rundll32.exe	30
PID 2536 wrote to memory of 2440	2536	rundll32.exe	30
PID 2536 wrote to memory of 2440	2536	rundll32.exe	30
PID 2536 wrote to memory of 2440	2536	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\__pycache__\file_name_convert.cpython-36.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\__pycache__\file_name_convert.cpython-36.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PoseTheCharactersBody\images\camera_anim_pose_01\__pycache__\file_name_convert.cpython-36.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bf91706bdfec456528c4386010ed4ab1

SHA1
aae54f422cce0b8f7f8eb204270976b04ad23a0a

SHA256
8367246346d8de6057b62c67b8de06801eedf1d6fb75ea2badb5ad64eaaca467

SHA512
e095e045d1891ee9479f750879a474cf90517cbcaef0b47f18a18ba456d9ca1f743b3a152f5b2ba71f483f96ee064ac147ede7f9809cb579d0cb44bead1776e6

Download Submit