Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    21/05/2024, 05:20

General

  • Target

    bin/AsRemoteCommandsHandler.pyc

  • Size

    49KB

  • MD5

    0cce18733b419438bca64e6f79cb75b5

  • SHA1

    d3f30ed452a774c0eb468c6e426a6665e131b49f

  • SHA256

    68841421ea718752bd8f280680b1801b25f10a42ace193c1814ce60d4ba33f77

  • SHA512

    1dbf0587087915c976184154ebb511d7c20c4fcd2cb90ac27940b68313726e72fe542a5ba832acfe3c8b186b99cc86355394be509bb38b02caf798d56c21bb7b

  • SSDEEP

    1536:2oB7EE67b3HECrWvX+pAAe7GRSTmLC+flAu9dmMuFA5UpWwXBLo+6W1jMA1hMATe:cE67b3HECrWvX+pAAe7GRSTmLC+flXdd

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bin\AsRemoteCommandsHandler.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    37800510f10174382d855cc7871e4f6c

    SHA1

    3d1e78133cf131d2765ef0f87fd090d95d7a3cf8

    SHA256

    87384e99b9646dfc3038d6ede150ff9c6c0bd72a7ac66e766cf60f096b812aa8

    SHA512

    3f28697a06c83f5b68e7d9f436f77a066c4da84b2894a67aec06b1780df04e769cdc4342fb7c138e1afafa96781e49c0e4578d2b6e850f83ecc4e9dae7b3db38