ceecefcf9cdd5c58e5b934ae568c241986f85df3ba4648dc925fc93b2243cbf8

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plpscripts_freeV2/plpscripts free ai aimbot/plpscripts_freev2.py
Size

20KB
MD5

1cd6ddacfd0574940e0b6db3c15e2ca9
SHA1

60878df601182387c53c0ff04568848344d81efe
SHA256

d19dd7dd045d9689038b12048df58afca4fb0d0e58b4588322abb6d3be1f1962
SHA512

51a3506737bc633cdeecf690cb780a0a27d9a5a984343e25e90153f7a8ed8b070100c6ba155abe4b00cbbd31f55b3801d0b2feae7511898a4d9ce66e5f4f4947
SSDEEP

384:vedcru/zST5dtFzRZADgnlBxOLOW/ra6GPEt4doE6fSfbjYFLAXdhiJAPjEZqwPn:veyu/zw5fFlmDtOVNEtPfK0VANhFjOqM

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2176 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2176 AcroRd32.exe
2176 AcroRd32.exe

pid	process
2176	AcroRd32.exe

pid	process
2176	AcroRd32.exe
2176	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2768 wrote to memory of 2700	2768	cmd.exe	rundll32.exe
PID 2768 wrote to memory of 2700	2768	cmd.exe	rundll32.exe
PID 2768 wrote to memory of 2700	2768	cmd.exe	rundll32.exe
PID 2700 wrote to memory of 2176	2700	rundll32.exe	AcroRd32.exe
PID 2700 wrote to memory of 2176	2700	rundll32.exe	AcroRd32.exe
PID 2700 wrote to memory of 2176	2700	rundll32.exe	AcroRd32.exe
PID 2700 wrote to memory of 2176	2700	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\plpscripts free ai aimbot\plpscripts_freev2.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\plpscripts free ai aimbot\plpscripts_freev2.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2700

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\plpscripts_freeV2\plpscripts free ai aimbot\plpscripts_freev2.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d543ae4002ffd7de3655e941c6c6aff6

SHA1
19d660e4764f462a47d935973888db064244484a

SHA256
31e6366d0e96c88aa6fe24e745b44b2151ddfabc51db2774eaca7b6ef8ce1e4e

SHA512
9f8cfea01b7960a8c9487e8cf99c8033011503e78873214651d0c5a659a777fb624851014aac4d1916d46a4e4f3e897ca7df0a0b42753bec9a6431256625a03e

Download Submit