fd8d899b17767f1f6ddb53565ce3cd48ee990c2a640889f1776c16634d3322f9

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

info.py
Size

437KB
MD5

b2ed0f053be3507e189e115ed64d050e
SHA1

54801091cd84b0afc8188f40edc51c651ff21023
SHA256

a3b4a9508d6143c42ec8fc05312ea9dc4bc52774453d42006cf6d80cb4a78332
SHA512

4dba3c36d7f420189f868217d69709a7a2afb1ee391e1b30330d17fdd11b58949caf1292b64c4995ee36164106793c443876942a05e9254172ef887fd8d0b969
SSDEEP

12288:nJkl9RpP2ymHTz8VlCfwW3PNKALbGIOrxFVlq8taK:Jkl9RlK8afwq8AGPrxFrq8taK

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
2660 AcroRd32.exe

pid	process
2660	AcroRd32.exe

pid	process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2012 wrote to memory of 2580	2012	cmd.exe	rundll32.exe
PID 2012 wrote to memory of 2580	2012	cmd.exe	rundll32.exe
PID 2012 wrote to memory of 2580	2012	cmd.exe	rundll32.exe
PID 2580 wrote to memory of 2660	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2660	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2660	2580	rundll32.exe	AcroRd32.exe
PID 2580 wrote to memory of 2660	2580	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\info.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\info.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2580

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\info.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2660

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
6471353b89e592999bd54cb760f70694

SHA1
5bff37678654b405830940fa295c8ecab89bcd68

SHA256
c742a90197359271f261638d91fda7d53ebc7b11cb2812ac65d0c20c97c2aad9

SHA512
f1e5ee5002768914a7c3efb471ecb3d819f523411d959ac37cd7452c44dee4bed70240595a064f433bf9e9ebeafba5f3f74d33c9dd4d1efb9ff11495066be92a

Download Submit