fe37d437b4da2b10a0dd4892b480399a1e5c8e280d292ac224112256b20815a2

Resubmissions

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rodows95Executor.py
Size

626KB
MD5

460feda70616f5d313713641a8246067
SHA1

c3649d345949dc5d6daf7a4de7a79a71acdb0a87
SHA256

fe37d437b4da2b10a0dd4892b480399a1e5c8e280d292ac224112256b20815a2
SHA512

56334caf02c33de9ba7bb292c1fc929881a8d2abc384b082f8e48bcda1bda34a13729f7b23b463cd790f9cad6ca1f639b4f6a1d0f233e7490b6fa489588b3b8f
SSDEEP

768:nMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMA:6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2112	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2112	AcroRd32.exe
2112	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2244 wrote to memory of 2612	2244	cmd.exe	29
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30
PID 2612 wrote to memory of 2112	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rodows95Executor.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rodows95Executor.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rodows95Executor.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a157784e5618e614a6e40e5cd8e9b407

SHA1
a8a00e7fefa65c35e37642a7ffe08984f74cf9c2

SHA256
a987de3add9e0de283cad0327eb6222fe66790231c404462c2cf1637a2955a1f

SHA512
ae8745c361e52cefe969006e71c50c3fc653eb91d03aaa4f4f083ac35537a6c881f96d1b1465ac863399de59b426601e546cdfd3f31a34023a11c524e4fa8439

Download Submit