905ff9db8198390e7148025b7ca8d7dc66b60028acfe44dd0372168e0d53edd7

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PhishMailer-master/Core/Languages/__pycache__/russian.cpython-39.pyc
Size

44KB
MD5

da9d7774dfd66a794f08b2563ee1b18f
SHA1

0047db9acffd95fe1fada24659402a84aa17a042
SHA256

88838e7b59478cedfbfcf50328f5022fc93bc729e22c29510d4574739f8eb042
SHA512

01ef410827812466be89b853653cbed6051c10e8a1e22ebe0679390ddb7db661b951029b69ea1d3ade1f1b663e2c78f32a73f8a3bdd91e464d2308765208bc05
SSDEEP

768:hcmo+7YetRvpph+cEdJ82fFTo1jXoKYre8M7rReGs:hcmoiYetRvpph+c8J82tMjce8M71ls

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2608	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2608	AcroRd32.exe
2608	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2516	2212	cmd.exe	29
PID 2212 wrote to memory of 2516	2212	cmd.exe	29
PID 2212 wrote to memory of 2516	2212	cmd.exe	29
PID 2516 wrote to memory of 2608	2516	rundll32.exe	30
PID 2516 wrote to memory of 2608	2516	rundll32.exe	30
PID 2516 wrote to memory of 2608	2516	rundll32.exe	30
PID 2516 wrote to memory of 2608	2516	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\__pycache__\russian.cpython-39.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\__pycache__\russian.cpython-39.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PhishMailer-master\Core\Languages\__pycache__\russian.cpython-39.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b8c630bcb2544bf111d9ea27a3aabf81

SHA1
3547af546e9d59319f3b52326ce8828c056324f0

SHA256
894c1bb26a7896b160627e456490eb23a928bcbe6f4e9160f6488d42558327e4

SHA512
615deed7165671d69a33b3a1ef05900febe736ecdaf5a430079c667e89f25144136e0382ba886feb99d5fe22bbccd0ff1eb7e2ea0629801b8665fcaa5b8a1572

Download Submit