6c9b4009168ebee862516cf066e506aed45dd0a977d233435aaf44083e2c23f6

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TT ViewBot v3.1/Data/ScrapProxie.py
Size 8KB
Sample240525-c3agvsbe7z
SHA256 8fd6afc4c92b8c65eb96a7493e559c83449578fcf178e20d9d126b411eead5e5
MD5 005e6b6cd75e6fd6040731c64494e537
SHA1 86f24fc5aad569829e0651bdcd607168c19c58f6
SHA512 a16848eda731c6e7591b94a7291095a19fca11ecdd2e4b1e55306f28b288bc473f2bad97bb505c0c8fd4d3a7e7227103427ac5aed1bf6bd3b21f6bce3e785931
SSDEEP 96:QSGcG6lghWnE559ZlWoxKMk59Vp+pvey9t9c9xsRvRxY1K7DpCgkTli:P659ZwoxKMW9Vp+pmYHexscU9j
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2656	1756	cmd.exe	29
PID 1756 wrote to memory of 2656	1756	cmd.exe	29
PID 1756 wrote to memory of 2656	1756	cmd.exe	29
PID 2656 wrote to memory of 3064	2656	rundll32.exe	30
PID 2656 wrote to memory of 3064	2656	rundll32.exe	30
PID 2656 wrote to memory of 3064	2656	rundll32.exe	30
PID 2656 wrote to memory of 3064	2656	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\TT ViewBot v3.1\Data\ScrapProxie.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\TT ViewBot v3.1\Data\ScrapProxie.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\TT ViewBot v3.1\Data\ScrapProxie.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 ab7c4f20b80ff20c0695ec59485d1fdab282f025d631c99ffd960512d832d6b4
MD5 8a0d1d5f67b725f6dcbb569e3cab60d9
SHA1 347531cc9cf53b018603e397d57f6eb03d37d764
SHA512 0642e3a8e32b8f8fd94fc63b04de6a979f19fab826208532a903f7e1df1fc20b53c75093df10addf1c2669986aa3e28ba3ac939d33be91b56f65269d3c1acf11
MD5 SHA1 SHA512

Submit Download