fd8d899b17767f1f6ddb53565ce3cd48ee990c2a640889f1776c16634d3322f9

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

time.py
Size

476KB
MD5

adce4880c75f4053b2aec6935a44584f
SHA1

e470344f4ea4567d562fe02b2b97afb60cdd807f
SHA256

c6ff57e7fe06cdade1f1254a52c3f8a4ea2f8f482f4e0918170cf6b2de7a232e
SHA512

ebb962fd05133744e64e89e9a499c1f576c7d44c43ecdfefe95ced43de3dc98397879dfb7ba0703b03e2bf080853d53f3f845d1dcd3c89dfb9064b1f4fc8601a
SSDEEP

12288:QwTY276z+KIAImlEaJVqHmHzOl8ixomTT4iO5GxtCP8fJP:vH76vIqEaLdTOl8ili5Gn0yh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2456 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2456 AcroRd32.exe
2456 AcroRd32.exe

pid	process
2456	AcroRd32.exe

pid	process
2456	AcroRd32.exe
2456	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2156 wrote to memory of 1584	2156	cmd.exe	rundll32.exe
PID 2156 wrote to memory of 1584	2156	cmd.exe	rundll32.exe
PID 2156 wrote to memory of 1584	2156	cmd.exe	rundll32.exe
PID 1584 wrote to memory of 2456	1584	rundll32.exe	AcroRd32.exe
PID 1584 wrote to memory of 2456	1584	rundll32.exe	AcroRd32.exe
PID 1584 wrote to memory of 2456	1584	rundll32.exe	AcroRd32.exe
PID 1584 wrote to memory of 2456	1584	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\time.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\time.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1584

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\time.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2456

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
62c0236c0487812a8766ab3054b9f104

SHA1
9e135c222f66282a0faa84e667e5fe3b53fa6d65

SHA256
40d9d2c39947c6a5203202dc82151190fcf38233fe6e7fd95835c73d1119a015

SHA512
9bfd570dfe4e0a5a30d4187049dfc3317981e939a34783e5953756df10520a13db7ba979fc9702c544314331ae880009418f2956ed1c7343f7ebbfd2e4cb0388

Download Submit