502b2bfc63c501480abe0209a1ad8889fba1903571d92da7b57990e2eee8b672

Analysis

max time kernel
1561s
max time network
1561s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-05-2024 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

GANG.pyc
Size

39KB
MD5

599306b7e7159b076399086c81519b3b
SHA1

d7b3050bc6fed6252750d06cccb0798d9799fc53
SHA256

95001b9b93a183bce1741be0eb526f25853be5d086120197f7715aa135a1e79c
SHA512

eb43339a2ef686d1f2829c29b837dfd2cfa10aeaf38568e21c63408d88dcf2a12d6854559cd9f91e758bb188fe79cd554123d9074232126de34c6ec1f182ebde
SSDEEP

768:0LyvlkA8e+W9p+Qbjv2DArJBg8FG8mpbdCrBNMunTrjZ+N1qPDOk:0Ly1Vrv2D84UnycFyunjZ+N1qSk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2456 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2456 AcroRd32.exe
2456 AcroRd32.exe

pid	process
2456	AcroRd32.exe

pid	process
2456	AcroRd32.exe
2456	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1312 wrote to memory of 2680	1312	cmd.exe	rundll32.exe
PID 1312 wrote to memory of 2680	1312	cmd.exe	rundll32.exe
PID 1312 wrote to memory of 2680	1312	cmd.exe	rundll32.exe
PID 2680 wrote to memory of 2456	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2456	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2456	2680	rundll32.exe	AcroRd32.exe
PID 2680 wrote to memory of 2456	2680	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\GANG.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1312

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\GANG.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2680

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GANG.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2456

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
8efcb59b4ce80d3935672838888b385e

SHA1
0a485ac4db538722175ae50fc2d277b4f9871dd6

SHA256
a83d9c979952c3c114233de3570b6dd5121a4e48aba0b4506192146cd90d61ee

SHA512
1a5d603c8152f44060b10d18f9825864990426489c8d16568ebb79ef78a79a54dba8d6e1da48ec8dd0dfaa9857e6130296610103fec8b1d924ff0ef7ba6a1b5b

Download Submit