Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-05-2024 16:13
Behavioral task
behavioral1
Sample
AIMr.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
AIMr.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
autopy.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
autopy.pyc
Resource
win10v2004-20240426-en
General
-
Target
autopy.pyc
-
Size
5KB
-
MD5
996ba99e569817ce1a8f2a5d88c58781
-
SHA1
33c135c089ba155ae43072a318b15af0ec6fa681
-
SHA256
dcc1b90c7a6eab4a6f5abc62d8390fe327f7a51a792c143c6983d0e293fbfcb1
-
SHA512
305e41e5337f55c93b3f6a478293da2b1273b15ee34f19013237f1bee3794ddd3518d6af51797fea06e94d3416a9dfc7485038e15258170ac08e1ea3fbc5d12c
-
SSDEEP
96:Y5rM+1hU5zSPCTHafPmgpj6vsbjOPikrn+yxfL9uXL/MtG:6M+1hUYaTHaX1pj60bjOPXn+yxfLUXLh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1932 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 1932 AcroRd32.exe 1932 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2744 wrote to memory of 2684 2744 cmd.exe rundll32.exe PID 2744 wrote to memory of 2684 2744 cmd.exe rundll32.exe PID 2744 wrote to memory of 2684 2744 cmd.exe rundll32.exe PID 2684 wrote to memory of 1932 2684 rundll32.exe AcroRd32.exe PID 2684 wrote to memory of 1932 2684 rundll32.exe AcroRd32.exe PID 2684 wrote to memory of 1932 2684 rundll32.exe AcroRd32.exe PID 2684 wrote to memory of 1932 2684 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\autopy.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\autopy.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\autopy.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD54e4ed9ba2b40e6bc5878dd5ebd942821
SHA1dadbfc5da18b0009e3819703e5467b214b263c68
SHA2561c1b2fe52a12b517f13eb58e3ae12001e7010ef6de82864d0b23aebd28f9ae4f
SHA51243bf7f815cd04da62e98f1157d67e93fb3e26f74c309aced8e140b2d3d0ef74c615caa98b6683358767321f032d1ee3d0587654bfaae74623a88d2675052251e