32abdd2910a308d9db26293a2be62184462ed68595d369b1002a72a614bfea72

Analysis

max time kernel
121s
max time network
126s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Components/postprocess.py
Size

2KB
MD5

49075e2d9fc465efc637dec05d1dc8ab
SHA1

715e7a50e1abc50df13cdb0626a027ce1fd520b5
SHA256

89074ee03413bc77d02c438831b318a98804823fadb6f972028f7951548a201b
SHA512

39c79ca0de2046ccb2d6cea4db2e7ebb84dfbc332964cfd6337e421ef4f70a2c0ae99d2154edf78caa2b8f2bb702702b71fbbc72fad2813fb745d96d3d7e05f9

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2816	2192	cmd.exe	29
PID 2192 wrote to memory of 2816	2192	cmd.exe	29
PID 2192 wrote to memory of 2816	2192	cmd.exe	29
PID 2816 wrote to memory of 2832	2816	rundll32.exe	30
PID 2816 wrote to memory of 2832	2816	rundll32.exe	30
PID 2816 wrote to memory of 2832	2816	rundll32.exe	30
PID 2816 wrote to memory of 2832	2816	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Components\postprocess.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Components\postprocess.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Components\postprocess.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2d16668cb7d3d6ff1c9943f3b46e5fd7

SHA1
1e2535e650afd29a51e94223dd684b6c0610e11a

SHA256
62bda632f66fa77391fe736230dac4ab1e2e7314d9859ecbc42f350c7a6c8f30

SHA512
1b9ac7166fb8f67a61e3d2e472b5a7f25b8cedb051d5687f0d0b96462aa4bb72ac0d0ff7459e3d18455228491a9e62c6d23dd79a52734bcf721675285370e0c3

Download Submit