Overview
overview
4Static
static
4freshwomen...hWomen
ubuntu-18.04-amd64
4freshwomen...hon.so
ubuntu-20.04-amd64
1freshwomen...api.so
ubuntu-18.04-amd64
1freshwomen...python
ubuntu-18.04-amd64
3freshwomen...ythonw
ubuntu-18.04-amd64
3freshwomen.../zsync
ubuntu-18.04-amd64
1freshwomen...ncmake
ubuntu-18.04-amd64
1freshwomen...47.dll
windows10-2004-x64
1freshwomen...GL.dll
windows7-x64
1freshwomen...GL.dll
windows10-2004-x64
1freshwomen...v2.dll
windows7-x64
1freshwomen...v2.dll
windows10-2004-x64
1freshwomen....7.dll
windows7-x64
1freshwomen....7.dll
windows10-2004-x64
1freshwomen...on.dll
windows7-x64
1freshwomen...on.dll
windows10-2004-x64
1freshwomen...rs.dll
windows7-x64
1freshwomen...rs.dll
windows10-2004-x64
1freshwomen...on.exe
windows7-x64
1freshwomen...on.exe
windows10-2004-x64
1freshwomen...nw.exe
windows7-x64
1freshwomen...nw.exe
windows10-2004-x64
1freshwomen...ay.vbs
windows7-x64
1freshwomen...ay.vbs
windows10-2004-x64
1freshwomen...64.dll
windows7-x64
1freshwomen...64.dll
windows10-2004-x64
1freshwomen...nc.exe
windows7-x64
1freshwomen...nc.exe
windows10-2004-x64
1freshwomen...ke.exe
windows7-x64
1freshwomen...ke.exe
windows10-2004-x64
1freshwomen...er.pyo
windows7-x64
3freshwomen...er.pyo
windows10-2004-x64
3Analysis
-
max time kernel
123s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 23:11
Behavioral task
behavioral1
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/FreshWomen
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral2
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/librenpython.so
Resource
ubuntu2004-amd64-20240508-en
Behavioral task
behavioral3
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/libsteam_api.so
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral4
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/python
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral5
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/pythonw
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral6
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/zsync
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral7
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-linux-x86_64/zsyncmake
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral8
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/d3dcompiler_47.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libEGL.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libEGL.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libGLESv2.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libGLESv2.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libpython2.7.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/libpython2.7.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/librenpython.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/librenpython.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/nvdrs.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/nvdrs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/python.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/python.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/pythonw.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/pythonw.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/say.vbs
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/say.vbs
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/steam_api64.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/steam_api64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsync.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsync.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsyncmake.exe
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/py2-windows-x86_64/zsyncmake.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/python2.7/BaseHTTPServer.pyo
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/python2.7/BaseHTTPServer.pyo
Resource
win10v2004-20240508-en
General
-
Target
freshwomen-season-2-episode-2-part-3-pc-720p-compressed/lib/python2.7/BaseHTTPServer.pyo
-
Size
22KB
-
MD5
17a30466cbfbed83fe96d52d029e4bf6
-
SHA1
8828b7b43360184f57bff03fafee2f2c9962c2e4
-
SHA256
122bc148794e6781fbc177e308ac15554ab2d3cc61607f76ffe9bc3b8784a1f0
-
SHA512
51dbdc7312809c4c7576874056bb81b764049727021fa57ff77a0b6c3e5becb9f7f269f2c6e422076c293b9fd437c53a15cc6f6e7a88ed309eb735863b783f44
-
SSDEEP
384:LphmB/EgvQlR4Cy9VLFvJYVQ4mfazUMYdpKm66R+TlHZ0eGEFgyogj2N:LphmB/1vmEHh0Qozx/m66R+B50eGEFPm
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
Processes:
cmd.exeOpenWith.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OpenWith.exepid process 4796 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\freshwomen-season-2-episode-2-part-3-pc-720p-compressed\lib\python2.7\BaseHTTPServer.pyo1⤵
- Modifies registry class
PID:452
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4796