Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    06-06-2024 07:04

General

  • Target

    tbk.pyc

  • Size

    3KB

  • MD5

    d8b7458a5a3348f1c80114e6fd6d5169

  • SHA1

    6ceb929dbd6ee5aa98e31011caa164e02a5e282b

  • SHA256

    2a96c8523b2c46053758d516847a193f82c7ea42bba62a67225eb86b36e1898a

  • SHA512

    89cca90cadf572cebbdfb57b7a7a3f5c7c9cc6acfdc5f2391db377dc7e34eedc7f3a0ca2fb91e6ce455ca087d6d30fba7cb4edf53fef006630b34081830a1405

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\tbk.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tbk.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2620
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tbk.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2772

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    5540b6c6d4f266cde49f17c862558058

    SHA1

    4a1fce051eab88d153b21afdccc7afb85d2ac433

    SHA256

    d5571449ac0eb3db854910fd6b10d4451b4ea93e2a478bf5f43abe3037ef9791

    SHA512

    78e0fbe7261ce561e75b7e480a87add4721c28c09b8c5f094aac2efa40d603f54a1719c8794739d90d2577ecb957d3acc3ddce853db6a618f6f71f6ee46a2fa5