Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 14:42
Behavioral task
behavioral1
Sample
RedeemCodeGen.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
RedeemCodeGen.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
RedeemCodeGen.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
RedeemCodeGen.pyc
Resource
win10v2004-20240508-en
General
-
Target
RedeemCodeGen.pyc
-
Size
3KB
-
MD5
8923dcc1b979bdfdf430f3588f699374
-
SHA1
31d4f80a961e32118ee6dfc256ea1466c22047e6
-
SHA256
a9aaa336b4b4ba52ca6db9e65697328b6612644d8599ef621aa2de9ee18bca0c
-
SHA512
020c2bb7ed4659a454d74795c27c444fdc818d6ccad47627aa015d032be4b6f363d4017a5f72b3e21fd60a6e5a640f88f0f73636a92621c830a2d935449a4535
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2688 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2688 AcroRd32.exe 2688 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 2768 wrote to memory of 2688 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2688 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2688 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2688 2768 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\RedeemCodeGen.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RedeemCodeGen.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RedeemCodeGen.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5b11076a2cba44c5e69005d93af5b9fff
SHA1b2bfcc9113bcc8c4df56e5bf423b274b24127a81
SHA256aa5fe42386934420d4a7da84f6c799e1da1438aaee4d2907f89b417202dcade6
SHA51280ffeefdbfcb9a2ec483086a6a16ee51cd37dc7c217d9b54e1f354b0fa1608809a6c1e8e553d972ef9718a6befca52688db99cd9b8f4f5ec4694c68ec031a53e