8f8e709127c6c77446a8c0a8c8bf3c8ee706a06cd44b1e827c3e6a2ee6b8c098

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cffi/api.py
Size

41KB
MD5

9a1a757b0127030bed2f3c83dfe3bc10
SHA1

5f4f649e0cbe10ee830f18b33cf0906ecb23c067
SHA256

c2d254d1a1940b74f26278c1220b0e225bfb76b175f6357ecbfb2bb7b73cca18
SHA512

91d33fa5d54134da1e3cf702a654167bf2dd130714c23c59990a10d939a46b1c4cc09ebd8ef75ee5de61c23d7c5954d2c5c24adfbf25f4fd0e37964a6fb54ead
SSDEEP

768:kT0mWvgM/YRObkuvypJAfhjpvRHLRbCi3o/Q:kAmjM/YROUpJAfhxZLRbCi3qQ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1616	AcroRd32.exe
1616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2676	3008	cmd.exe	29
PID 3008 wrote to memory of 2676	3008	cmd.exe	29
PID 3008 wrote to memory of 2676	3008	cmd.exe	29
PID 2676 wrote to memory of 1616	2676	rundll32.exe	30
PID 2676 wrote to memory of 1616	2676	rundll32.exe	30
PID 2676 wrote to memory of 1616	2676	rundll32.exe	30
PID 2676 wrote to memory of 1616	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cffi\api.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cffi\api.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cffi\api.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7cd5ebeb9080b568d8881aa1882cb361

SHA1
8d24d977191764e89d05e36e4386dacca1ebdedf

SHA256
91fbe5deafdab571935d5ae2b2a530c938e146bf621f4b8036a6b0d949fb6f4c

SHA512
1856e17aa11842f7df177b4b53a268882873e637703830e22943fffd982a6acb0443ef01b71201f590513aab831d19f3e70cab11b85cc774ad190339dfcaaa20

Download Submit