Analysis

  • max time kernel
    361s
  • max time network
    361s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    06-06-2024 08:11

General

  • Target

    Stuff.pyc

  • Size

    6KB

  • MD5

    d3b84caf1d40793f0f60dd806da0af41

  • SHA1

    2cac5ca380f80f62e9b2e34066c0052e8a13a1ff

  • SHA256

    feea6f04637ae5b5103b1e39670ac80123ab208ec5704363b32143427e8b1efe

  • SHA512

    f1cf732c34f7c842dc297bb982e567f54c4a73c6705d31dbc8686b1affd891853367487f4ef37f301b95fe5aa392831db8111e72d2f5a43fb79862fad3ff4623

  • SSDEEP

    96:stfPEZXaAzphdU6GgVSIx+LNm4nJMMBQoXy/6iq:spPmXfVSC+LdJRXc6Z

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Stuff.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stuff.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2608
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stuff.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2072

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ad483d4ab2d94fbf3be9557d3bea2300

    SHA1

    37a0621458bef9210697f760ff16b2249f18121c

    SHA256

    d8cfb168754dd1b677ed07adf5c7af6949c0d0460275510b115a4b8b12160c03

    SHA512

    1f1272691e6cf0a35f5490767ecd5de978c207213cf47df6ba178ec5e9114fea5b0cd8ddceec0c6847e021b24e086859f4b0cea94c2aac301eb9f254c5250b6a