8f8e709127c6c77446a8c0a8c8bf3c8ee706a06cd44b1e827c3e6a2ee6b8c098

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 06:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cffi/cffi_opcode.py
Size

5KB
MD5

28c29f6bb1b4a4ad9d94769b233378af
SHA1

a4903bb6e38a5ea65f8e16ed2809c89dd125d04b
SHA256

bfd45d0ffa2f03cac2b6ab02f7922f922e55ebaeeb00e84682cddf6f6abdc693
SHA512

582a94cde83c1ec8721b26e79836276e61a98697924ba0380f2951a3355679e3b7b0a18243624965b2f2cea1e56d81060badb910053e648cdd324f22a445e4eb
SSDEEP

96:pyHV2pF5LRofKKdiyqwyjjmN7kihsDtEyiokEEMiwfBX313fvEyhGt:MspXLeNyWXYKokEEPyhGt

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2664	AcroRd32.exe
2664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2604	1984	cmd.exe	30
PID 1984 wrote to memory of 2604	1984	cmd.exe	30
PID 1984 wrote to memory of 2604	1984	cmd.exe	30
PID 2604 wrote to memory of 2664	2604	rundll32.exe	31
PID 2604 wrote to memory of 2664	2604	rundll32.exe	31
PID 2604 wrote to memory of 2664	2604	rundll32.exe	31
PID 2604 wrote to memory of 2664	2604	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cffi\cffi_opcode.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cffi\cffi_opcode.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cffi\cffi_opcode.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a441094a877893223624bb4e5a2bb845

SHA1
17c2dac8dc526bc59c61458ceb1de18bbe368f5d

SHA256
6408fa410e242220eb498ebae8cbac22231c082708d2bca2260c115b3b2544fb

SHA512
6eeff71dbde3e443b4fe04790fd70d584aafc03739fdbbd0a214399d2ce845aacd3e2d3a81bf7f2f38f72573293d5b84d53457a981ac985ffcf153c702713185

Download Submit