2ee45921f9264eed67f150b3871c2a40cfadea0fc781fd14da10a3a1bbc94bc7

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 21:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

8d37f316447dbc4c9b2f5c3bd6ffc714
SHA1

60f082864e47a04771e608cb57d3f28840155430
SHA256

f99f867c0f5d238dc4adbc541c8d252303bf1e9843a932819d2bcdfe897f1811
SHA512

9706a3ebf826eb1f20aa828383486d8bf7e14736570bed783291dbb740ffe697570b66430a84dc0384ce71e7b6116dfaa34f2200751d8d4b8833f50d130cf234
SSDEEP

96:zTAjADtHozb9dS5be24D3VgANPEkUwNHnxTYCJK:IjsHozfCbe223VgANPDU2n6C4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2808 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2808 AcroRd32.exe
2808 AcroRd32.exe

pid	process
2808	AcroRd32.exe

pid	process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1964 wrote to memory of 2724	1964	cmd.exe	rundll32.exe
PID 1964 wrote to memory of 2724	1964	cmd.exe	rundll32.exe
PID 1964 wrote to memory of 2724	1964	cmd.exe	rundll32.exe
PID 2724 wrote to memory of 2808	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2808	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2808	2724	rundll32.exe	AcroRd32.exe
PID 2724 wrote to memory of 2808	2724	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2724

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2808

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
e7bd37b7297d6819b265a874954e154d

SHA1
3bc3f386df246265290d8aee9989da29c2b1f67a

SHA256
0510c8ce1a2eb2c29ada8e4f286bcffb4f4f4939efa0eff07a84763fa92d679d

SHA512
1c6e55af7c273293f3f133cc912803ded65ec85e0987bfa8888279a2b0333c2d53e427e2ecba7c5e9f47d71249546d5824c24d16ef77b5b763db26cea622dbaf

Download Submit