087c633e355bc709222ad9e0dbad77abeed84f7e06dbdbecae84ba8b3660429e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

imports.pyc
Size

9KB
MD5

16470ba5e9f055fcbc5b7d12a9d2332a
SHA1

3009f4b85c34f21fab451da73c588f9a608eafc9
SHA256

e77dea05f19665f6638463416175bd0367e7484a8dae3b5fa8c61759c2ca0c2d
SHA512

0f730400ef46331dfa4839ddd24e8dccb2e500070f79ac0ed4ec23e7b5e7127d35096f264e1dfa60de40182b8cb1279dcd75e3ada79040083bab0b43432b1c54
SSDEEP

192:KFE9N6Adlk+w466kjmllLvjjwNmlJwnXgY30LnGAWg/vSvQd0Ba:KFEPWJqkjmllLvjjwNmlJwnXJTovSeya

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2816 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2816 AcroRd32.exe
2816 AcroRd32.exe

pid	process
2816	AcroRd32.exe

pid	process
2816	AcroRd32.exe
2816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1868 wrote to memory of 2732	1868	cmd.exe	rundll32.exe
PID 1868 wrote to memory of 2732	1868	cmd.exe	rundll32.exe
PID 1868 wrote to memory of 2732	1868	cmd.exe	rundll32.exe
PID 2732 wrote to memory of 2816	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2816	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2816	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2816	2732	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\imports.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\imports.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2732

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\imports.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9994bd8df8ac31fe3c506641b867df41

SHA1
f7eda8a17e7cd81fa9a02dd9a3c69a9ff941a0ac

SHA256
b52b2559665acc50a13376ada4a9400339f0f6e8e8dcf158186d877f1f127eab

SHA512
3e67346f22c4cc1108b303f01561a0d36673abc8efacc45b449b39f974d156ea0805383f31c271f76e9d8d4f7ab4bb35a68a1818ad5153d95e19cec890d40123

Download Submit