Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28-05-2024 12:00
Behavioral task
behavioral1
Sample
mass_report_script.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
mass_report_script.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20240508-en
General
-
Target
Stub.pyc
-
Size
876KB
-
MD5
9fbdec4dae910fe824e2a687cd880232
-
SHA1
8b462b769e74de90f8b4a4eeef434fbf9e552b71
-
SHA256
d1f14d6147531a91456f7a849b3c05f83ce2df8d5f49e464eb2ab29f243431d3
-
SHA512
008522d8fb9400d2aae32c6e3bb43eb3163ef3e2344b2b5cc1c8e5659cf5ba3d2d7c7b3012f7939efba5b9e103206062dc18a5f872398a3148c3e1f6d553a41c
-
SSDEEP
12288:L4qEsMM56G0XODlk09mDEpIUdJq+gh/1yKLGUt/zjjIpstn5eqSUcKExqo0Bpn:8qfwEDl79mDKwh/1yUtUpsbjzXn
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2256 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2256 AcroRd32.exe 2256 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 3012 wrote to memory of 2768 3012 cmd.exe rundll32.exe PID 2768 wrote to memory of 2256 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2256 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2256 2768 rundll32.exe AcroRd32.exe PID 2768 wrote to memory of 2256 2768 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD52fc9040a5a935e29ad80626b70ddff97
SHA14e842ba1c96c983344fe86b0297f1201c81a8631
SHA2567c2cf4164f1dec583f736c91f890acc7a884f60917c529b7a31a97689c61103a
SHA512c7351ab3c2077aed31f19125d0f5ab69a3a515ee9de905e13d930b887e55243628b70d702045a1bbee9ebc242ab859ed0b64b69dc386ec025c5db743ecb5e326