32abdd2910a308d9db26293a2be62184462ed68595d369b1002a72a614bfea72

Analysis

max time kernel
0s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Components/sigthief.py
Size

10KB
MD5

d3559eae0b0d56c618f1cb4c84007f62
SHA1

482d6667850b42afeda3af132dbf3b3b76afe966
SHA256

a795b6f56664614188ff7e3f7168eed5c88c820423a17200358e79325265e082
SHA512

6ecfb74e74c5c0adb4f47448c3db3d0db6333a5635f2f1ac0cca0e1289080e5c9c01094eab1c5722a74d21b302296304d8c6cff00e1b7172a2d4d1b467d1a608
SSDEEP

192:0/j5U9+6E0yWYSF/DwI6CRH2dCYwqSfU15dkAJH:06yMSfUU1l

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 2956	2912	cmd.exe	29
PID 2912 wrote to memory of 2956	2912	cmd.exe	29
PID 2912 wrote to memory of 2956	2912	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Components\sigthief.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Components\sigthief.py
  2⤵
  PID:2956
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Components\sigthief.py"
    3⤵
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
fccb3640131b2654c8c6907d03ea84ae

SHA1
89fd89ec65ccb982cf50a5c63ade5a809e8491df

SHA256
42da3b71d3c95db872d737793174d58dcdc7985e218104541a4828a2146cf7e2

SHA512
4370a188d6b11e132224a993b6fdcb0bed029cda22200bd6cd597578ac6d0826bb5e1e21bf3b6bbb4ff4f25fe048af2e7bf80facb094b3dab843f29d22216888

Download Submit