21d5cc62e1e9c967f89a944bd62f92f5f952f5e0e6c84b4732ae5167efa106a9

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
06/06/2024, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SOLARAB.pyc
Size 44KB
Sample240606-pknb8afa55
SHA256 b2a3b5f61d94decaa3e4bf6fd9d4836525413b75d9c11370cfbb84a2a89d8d03
MD5 0b4fbb0e2121e8d85e9e324307b2f186
SHA1 fc14e82fb8ad20db541a650c8b3f377683079e15
SHA512 42a8a9cc7d0c3da2188251e5457de364040f2024800b885d9d18cc96d46da447fdcda53090ed925089de7191f206a310b4edd4f0ddf271b63f0ca407fd138485
SSDEEP 768:n9JWQMr0q6nEPqm0HSmwUqRe8Ie2cxtaaEws4YHE6D9fJOyeWDlhLx3+pJ6y:n9JWh4q6noqmI+1Rr6cxRPeEuTdNDlho
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3036	1680	cmd.exe	29
PID 1680 wrote to memory of 3036	1680	cmd.exe	29
PID 1680 wrote to memory of 3036	1680	cmd.exe	29
PID 3036 wrote to memory of 2672	3036	rundll32.exe	30
PID 3036 wrote to memory of 2672	3036	rundll32.exe	30
PID 3036 wrote to memory of 2672	3036	rundll32.exe	30
PID 3036 wrote to memory of 2672	3036	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SOLARAB.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 9642fb253b3c8f19d1e1efdd20e81eae2b88864f5a68123fee700877d6a7ef3d
MD5 edbd5eb877df1be8761feb2472410935
SHA1 44b36b7377005b83d383012427c305e7aa7df596
SHA512 ece45ca9fdba6b42decf72787d778e4f0da3dd4f0ee30cb351e98a1e786dafcf5a9a5e3a761ce92819791ea34a9f8fbdb080d054fed69970c30e2778a3a6b503
MD5 SHA1 SHA512

Submit Download