be2beeba610a7cbb54affed764ba0d839be292cfffd63390491406c92c179a76

Analysis

max time kernel
117s
max time network
125s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 13:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

injection.pyc
Size

29KB
MD5

b6dec3de064cf4f9ed4672b11e6573ae
SHA1

32eee5530c7a267c8e37ba5c5f1c3cb71381cf58
SHA256

aa9e8bc539034a85bbd9c104bce9d6e340177573a7d5ecd3d3f912e7b925b371
SHA512

4e1e4cfa7121f4309d3787c3e1f2889a85019138e6d66fa9481764baa03a4726b307bec7f916597d206c22b17853179db7140a1528d3a788ee02dbbc74668f0c
SSDEEP

768:v5Qf/hsh1ahO5duy9OA6Uv/w3wAHJmwXGAODb:v5c/cw3AcVO3

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 2700	1436	cmd.exe	29
PID 1436 wrote to memory of 2700	1436	cmd.exe	29
PID 1436 wrote to memory of 2700	1436	cmd.exe	29
PID 2700 wrote to memory of 2620	2700	rundll32.exe	30
PID 2700 wrote to memory of 2620	2700	rundll32.exe	30
PID 2700 wrote to memory of 2620	2700	rundll32.exe	30
PID 2700 wrote to memory of 2620	2700	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\injection.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\injection.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\injection.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bdf7bb9cbe09f16201e807cd4a446cb1

SHA1
35ba1ebed2fe4e3d57aa80359c4296e5c6cf3340

SHA256
39f452b0e37b5aa572b7184a41b7ffb0a4540828437b1bfeecbcac1927855581

SHA512
032882cb9302095d240ec384c9b17464711bb88398b8120fd233b5a4bea8432f0ddf1e156483bb5609b577b2c820c2d8d0b392b8ed1f24391792b06ccf962ab2

Download Submit