Analysis Overview
SHA256
0e4f539b03dd958e671132b5ef330658abce425fd942483195191f4e0f443830
Threat Level: Shows suspicious behavior
The file 17526565097.zip was found to be: Shows suspicious behavior.
Malicious Activity Summary
Loads dropped DLL
Enumerates physical storage devices
Detects Pyinstaller
Unsigned PE
Modifies registry class
Suspicious use of SetWindowsHookEx
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-06-04 11:21
Signatures
Detects Pyinstaller
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral4
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win11-20240426-en
Max time kernel
146s
Max time network
150s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 4648 wrote to memory of 3520 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
| PID 4648 wrote to memory of 3520 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
| PID 4648 wrote to memory of 3520 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI46482\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI46482\base_library.zip
| MD5 | e14d09dd7b6aab745e07669c897cea32 |
| SHA1 | 14d43204d3107e7d5aa8aef287caa426b53197f5 |
| SHA256 | 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0 |
| SHA512 | ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a |
C:\Users\Admin\AppData\Local\Temp\_MEI46482\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI46482\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral7
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win10v2004-20240226-en
Max time kernel
141s
Max time network
150s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DDRI.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 58.55.71.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 0.159.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 95.221.229.192.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.219.191.52.in-addr.arpa | udp |
| GB | 23.44.234.16:80 | tcp | |
| US | 8.8.8.8:53 | 209.205.72.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 103.169.127.40.in-addr.arpa | udp |
| US | 13.107.253.64:443 | tcp | |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.94.73.104.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 105.83.221.88.in-addr.arpa | udp |
| NL | 52.142.223.178:80 | tcp | |
| US | 8.8.8.8:53 | 30.243.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 144.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 14.179.89.13.in-addr.arpa | udp |
Files
Analysis: behavioral1
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win7-20240221-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
Network
Files
C:\Users\Admin\AppData\Local\Temp\_MEI26762\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
\Users\Admin\AppData\Local\Temp\_MEI26762\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI26762\base_library.zip
| MD5 | e14d09dd7b6aab745e07669c897cea32 |
| SHA1 | 14d43204d3107e7d5aa8aef287caa426b53197f5 |
| SHA256 | 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0 |
| SHA512 | ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a |
\Users\Admin\AppData\Local\Temp\_MEI26762\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral2
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win10-20240404-en
Max time kernel
128s
Max time network
135s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 210.143.182.52.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI4202\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI4202\base_library.zip
| MD5 | e14d09dd7b6aab745e07669c897cea32 |
| SHA1 | 14d43204d3107e7d5aa8aef287caa426b53197f5 |
| SHA256 | 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0 |
| SHA512 | ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a |
\Users\Admin\AppData\Local\Temp\_MEI4202\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI4202\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral3
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win10v2004-20240508-en
Max time kernel
140s
Max time network
100s
Command Line
Signatures
Loads dropped DLL
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: 35 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1320 wrote to memory of 3080 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
| PID 1320 wrote to memory of 3080 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
| PID 1320 wrote to memory of 3080 | N/A | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe | C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe |
Processes
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe
"C:\Users\Admin\AppData\Local\Temp\22394f73cb3b087d0aae1b8adf65dbd33fb9974e4d4f78ca8a23b39e0868d4b9.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 232.168.11.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 154.239.44.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 183.59.114.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 56.126.166.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 140.32.126.40.in-addr.arpa | udp |
| NL | 52.111.243.31:443 | tcp | |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 203.107.17.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | tse1.mm.bing.net | udp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 204.79.197.200:443 | tse1.mm.bing.net | tcp |
| US | 8.8.8.8:53 | 88.156.103.20.in-addr.arpa | udp |
Files
C:\Users\Admin\AppData\Local\Temp\_MEI13202\python37.dll
| MD5 | 465089eaced8159ec533e4a37033e227 |
| SHA1 | 074596adae6f53f33b8297f02e21f6a6f7ac6ff1 |
| SHA256 | 2b29ae140cb9f08af872acf9e17f785ef99398ef3367549b55242bc064d6ae40 |
| SHA512 | 55eca0922074162c22fff2b4f97bd2972540fa893b9b02b7d9bfa26345186dbbdaf1fbc37a9eba6366743d0d42fb5bb88e708877dfd57cb02ca4d3a6953cfb81 |
C:\Users\Admin\AppData\Local\Temp\_MEI13202\VCRUNTIME140.dll
| MD5 | aeab74db6bc6c914997f1a8a9ff013ec |
| SHA1 | 6b717f23227d158d6aa566498c438b8f305a29b5 |
| SHA256 | 18ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b |
| SHA512 | a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036 |
C:\Users\Admin\AppData\Local\Temp\_MEI13202\base_library.zip
| MD5 | e14d09dd7b6aab745e07669c897cea32 |
| SHA1 | 14d43204d3107e7d5aa8aef287caa426b53197f5 |
| SHA256 | 0dedb58f116661f082982382a43fae8fd442b73f30651f3d15466db4835b92e0 |
| SHA512 | ed950910749159964df6a63646eaceef59a9334d05fd1ca6f38d02e8c116b0c53c3b23b55179f7ef128511ad278df3dda8c6d427b4e8459303afd012b2c7b41a |
C:\Users\Admin\AppData\Local\Temp\_MEI13202\_ctypes.pyd
| MD5 | 10861d3fa19d7dc3b41eb6f837340782 |
| SHA1 | b258d223b444ab994ec2fec95acaa9f82dc3938c |
| SHA256 | 6255bab0b7f3e2209a9c8b89a3e1ec1bbc7a29849a18e70c0cf582a63c90bed1 |
| SHA512 | ec83134c9bce9cedeee8ebdb8e382fb7f944a7bc9d3bb47c7e3144ef2ef95114a36ac1cc8c0d52f434ee4c359d938a2d7c035e699c4407df728e200de7da4af9 |
Analysis: behavioral5
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win7-20240508-en
Max time kernel
121s
Max time network
122s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\ | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.pyc\ = "pyc_auto_file" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell | C:\Windows\system32\rundll32.exe | N/A |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" | C:\Windows\system32\rundll32.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\pyc_auto_file | C:\Windows\system32\rundll32.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
| N/A | N/A | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 1244 wrote to memory of 2240 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1244 wrote to memory of 2240 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 1244 wrote to memory of 2240 | N/A | C:\Windows\system32\cmd.exe | C:\Windows\system32\rundll32.exe |
| PID 2240 wrote to memory of 1928 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2240 wrote to memory of 1928 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2240 wrote to memory of 1928 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
| PID 2240 wrote to memory of 1928 | N/A | C:\Windows\system32\rundll32.exe | C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DDRI.pyc
C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DDRI.pyc
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DDRI.pyc"
Network
Files
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
| MD5 | b262300a938cee6ce348608795f2d57c |
| SHA1 | 3fe58d96388a3910d55d2270fc00351124d2e62c |
| SHA256 | 38f104c12d706412953629aeef309fceb901f1f1603c21933ea65953a7921d95 |
| SHA512 | e33fe1019b8daff5facfca8871f0567e2be8cbb34af963994465c6968bd75f1b5b3f2b0dbd75bed33868129a87807a441fd11919aa0c0ea570d0d7fe336fc859 |
Analysis: behavioral6
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win10-20240404-en
Max time kernel
133s
Max time network
136s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DDRI.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa | udp |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.193.132.51.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 172.210.232.199.in-addr.arpa | udp |
Files
Analysis: behavioral8
Detonation Overview
Submitted
2024-06-04 11:21
Reported
2024-06-04 11:24
Platform
win11-20240419-en
Max time kernel
91s
Max time network
95s
Command Line
Signatures
Enumerates physical storage devices
Modifies registry class
| Description | Indicator | Process | Target |
| Key created | \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings | C:\Windows\system32\cmd.exe | N/A |
| Key created | \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000_Classes\Local Settings | C:\Windows\system32\OpenWith.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\system32\OpenWith.exe | N/A |
Processes
C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DDRI.pyc
C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 14.227.111.52.in-addr.arpa | udp |