1d498c6ee309a5f60cc9696f64782f6f62cbc2c6f5a4e6dff01bc3fd888ba725

Analysis

max time kernel
119s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21/05/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bin/asremote-srv.pyc
Size

50KB
MD5

54726e45376838ada3efc5435c55be26
SHA1

016ee957ec132c9d19afe069ec7705d0c1727703
SHA256

48696bc8424f2d59100e609591fcd11e3407d033e518c8cd9b9e07fbfef49553
SHA512

f5dec84a9c1777006fceba59a95391740f4cce5e7cec6d25cefebf59770a1119fab0cb4a58f03642f53d19b72598adb575d28ae58a0f45d111a1688710eff7bd
SSDEEP

1536:q3RT7IIlgovEoWNV40AGcUIL3x0DkzuajUCQsV+BLEGBS81mD8JJl6qxjaF/Ei6t:EoIlgovEoWNV4XGcUILx0DkzuajUCQsM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2656	2416	cmd.exe	29
PID 2416 wrote to memory of 2656	2416	cmd.exe	29
PID 2416 wrote to memory of 2656	2416	cmd.exe	29
PID 2656 wrote to memory of 2616	2656	rundll32.exe	30
PID 2656 wrote to memory of 2616	2656	rundll32.exe	30
PID 2656 wrote to memory of 2616	2656	rundll32.exe	30
PID 2656 wrote to memory of 2616	2656	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bin\asremote-srv.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bin\asremote-srv.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bin\asremote-srv.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
adcda85ca234d4645c8d6a1fa608c6f6

SHA1
1574caf02afb0613e565c55ae3280da09877bc52

SHA256
83aaf7a3fe12189bb5a4b3c0d8884e037b3df5be28eef080d309315b50cb75ce

SHA512
cc32c181a04f3ff5b390a0d417070ce1178be6c638a14e37472b6fec69ec5c46d1e2f490595b1449ca16ae89b520580f4a78c8c54b1dc97d4f440e48d6d5c595

Download Submit