89e8fb748043d1bdbfb84dd8d5bdcc16c5a1fd0f0e9d8e603a4e64490e04963b

Resubmissions

13/05/2024, 11:24

240513-nh59ksdb56 8

13/05/2024, 11:20

240513-nfswgaca8z 3

12/05/2024, 17:12

240512-vqxezaff8v 8

Analysis

max time kernel
118s
max time network
125s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Nitro-Generator-Checker-main/main.py
Size

1KB
MD5

9fd42c59e9c762869f90ee30ed5cd274
SHA1

53c9940da91be689d5bc0679aca57395132aacda
SHA256

b6305f88439dcfb48fedca3771f23ac1f2e3e6c7af3a5b329877fb876173f3da
SHA512

094e9e0e5b6ed6aaa3fbee22cb5bd822a624cd1895e83d1fd3d633ec26b451bae28a75174e94ce94fdf941f6cc7fd428cc4675ad1c6afdae812034b4ac0206a5

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
812	AcroRd32.exe
812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2844	1720	cmd.exe	29
PID 1720 wrote to memory of 2844	1720	cmd.exe	29
PID 1720 wrote to memory of 2844	1720	cmd.exe	29
PID 2844 wrote to memory of 812	2844	rundll32.exe	30
PID 2844 wrote to memory of 812	2844	rundll32.exe	30
PID 2844 wrote to memory of 812	2844	rundll32.exe	30
PID 2844 wrote to memory of 812	2844	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-Checker-main\main.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-Checker-main\main.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Nitro-Generator-Checker-main\main.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
77ac5ffc9c550963c761fe3be7c7579e

SHA1
518f8e569c53a364aaf2a69ec535f38b83abf8f0

SHA256
5a2edf127590ded5c5c5ffb5290ae7636a82d849ddb6c87767f4083271f14b9e

SHA512
d58c1b6a740c98470ec7a587073cc3f971c408119ea2f0d38bf3e2de9a93ea27a0b818c9498f03b7efd7bf6bbd5cc2646b47cf6b3c1e28b979423ba813140e64

Download Submit