c9f301b4e6c05295793faaeadd2e942593d9259719623e2d6b2970b741ae225f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

src/menu.py
Size

6KB
MD5

724e2b777228823748e2d3c5189adecd
SHA1

3bcaa5ce4f0e233ad746ee76b49ab74532f3249c
SHA256

5b6a018aab2eb04a974f2128609a1be7be37ed6ad390bc25841ed591abbcf1a9
SHA512

2734f5de9cabefa15ccaae1b3b4488dbf8d5f65fc36beb0e514939a6a41ea5e84e889aa0684733592e1a63a8345a0fe1149c408da455e5a9f5c3190c9a82ab12
SSDEEP

192:lcHY5wTaHqNugOhx5E04ejlmwewaS3FszuS368ZeiUR03TWYf2A42UWJjo0e6wWV:MxTA7E0jJmbwluzpEoTrf5k/6RumCt1c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2548	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2548	AcroRd32.exe
2548	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 2564	1504	cmd.exe	29
PID 1504 wrote to memory of 2564	1504	cmd.exe	29
PID 1504 wrote to memory of 2564	1504	cmd.exe	29
PID 2564 wrote to memory of 2548	2564	rundll32.exe	30
PID 2564 wrote to memory of 2548	2564	rundll32.exe	30
PID 2564 wrote to memory of 2548	2564	rundll32.exe	30
PID 2564 wrote to memory of 2548	2564	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\src\menu.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\src\menu.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\src\menu.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c0a4999cd489b74556aa7493a9848943

SHA1
588813ca1e5ab327868da4226843a3ffb1d38f4b

SHA256
de79b33d6d5721bf87d23f883371f637e17bea3ad5f229c3e501fdb3fc439c07

SHA512
48fdd82d14c0def71c1b947814b43df3f066625acd21d78a8173791f74df12585806cb57e4974801361cbd25fa39323ca37c4bf5d15295130820ad32d637830b

Download Submit