Analysis
-
max time kernel
361s -
max time network
361s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06-06-2024 08:11
Behavioral task
behavioral1
Sample
FeatherBootsrapper.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
FeatherBootsrapper.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
Stuff.pyc
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
Stuff.pyc
Resource
win10v2004-20240508-en
General
-
Target
Stuff.pyc
-
Size
6KB
-
MD5
d3b84caf1d40793f0f60dd806da0af41
-
SHA1
2cac5ca380f80f62e9b2e34066c0052e8a13a1ff
-
SHA256
feea6f04637ae5b5103b1e39670ac80123ab208ec5704363b32143427e8b1efe
-
SHA512
f1cf732c34f7c842dc297bb982e567f54c4a73c6705d31dbc8686b1affd891853367487f4ef37f301b95fe5aa392831db8111e72d2f5a43fb79862fad3ff4623
-
SSDEEP
96:stfPEZXaAzphdU6GgVSIx+LNm4nJMMBQoXy/6iq:spPmXfVSC+LdJRXc6Z
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2072 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
AcroRd32.exepid process 2072 AcroRd32.exe 2072 AcroRd32.exe 2072 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1624 wrote to memory of 2608 1624 cmd.exe rundll32.exe PID 1624 wrote to memory of 2608 1624 cmd.exe rundll32.exe PID 1624 wrote to memory of 2608 1624 cmd.exe rundll32.exe PID 2608 wrote to memory of 2072 2608 rundll32.exe AcroRd32.exe PID 2608 wrote to memory of 2072 2608 rundll32.exe AcroRd32.exe PID 2608 wrote to memory of 2072 2608 rundll32.exe AcroRd32.exe PID 2608 wrote to memory of 2072 2608 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stuff.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stuff.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stuff.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2072
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5ad483d4ab2d94fbf3be9557d3bea2300
SHA137a0621458bef9210697f760ff16b2249f18121c
SHA256d8cfb168754dd1b677ed07adf5c7af6949c0d0460275510b115a4b8b12160c03
SHA5121f1272691e6cf0a35f5490767ecd5de978c207213cf47df6ba178ec5e9114fea5b0cd8ddceec0c6847e021b24e086859f4b0cea94c2aac301eb9f254c5250b6a