905ff9db8198390e7148025b7ca8d7dc66b60028acfe44dd0372168e0d53edd7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhishMailer-master/Core/Mailer/__pycache__/MailerMain.cpython-39.pyc
Size

7KB
MD5

b243c7aa761ad4719b8e4d7a0e8785a6
SHA1

45627ef7562e81e456056de56a4d4d91e44e38d4
SHA256

0c7f276a3c07791b6e62a296bac11134105b5d6c0ef900bcb79ae9c6680f47b9
SHA512

d1f2e0157c502af64ddec30bf6bf107e6ee17688895c90233440965b939a16fcb5cbabdadee67c1c976cc702ea6ccfde80454a58a41827d0b8971d2c96ab028e
SSDEEP

192:4zxLBH8GJ74ZEThe/+ehkEzkFkjZkISk1lkhNjDWgBH4:MBHJaZEThe/+ehkCkFklk9kPkjnFh4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 1164	1216	cmd.exe	29
PID 1216 wrote to memory of 1164	1216	cmd.exe	29
PID 1216 wrote to memory of 1164	1216	cmd.exe	29
PID 1164 wrote to memory of 2652	1164	rundll32.exe	30
PID 1164 wrote to memory of 2652	1164	rundll32.exe	30
PID 1164 wrote to memory of 2652	1164	rundll32.exe	30
PID 1164 wrote to memory of 2652	1164	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Mailer\__pycache__\MailerMain.cpython-39.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Mailer\__pycache__\MailerMain.cpython-39.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Mailer\__pycache__\MailerMain.cpython-39.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cee94bacd6d14c706998a8a3af572afe

SHA1
8e3f7dd56f5f9c1bbfaaec696737c07f1334ba6b

SHA256
e547cd4d254ba3f631f3105d0f56fb5d5cfb0dd4f1907376dd870c77fb9c437b

SHA512
b97478666eb6ad297299d724cdf7284ac1fa738d6a8d087c6f8f8392e9eee04012cab9d02c92aecf913595ee3408c4fb718e428f79a1069d6c16e57250ac4a29

Download Submit