4adc278c3a8b45e1a99f82f7561ef319c17a0150ec316da40727441c5bf18bdd

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
07/06/2024, 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Luna-Grabber-main/options/AntiSpam.py
Size

578B
MD5

4ea7b29ea782f98ed9553b0da35a728c
SHA1

1d19271948816d2cd8dcbdf5ea246aecfd3b2258
SHA256

65e7aa358eb37087ea43057f48d46b39d27ab1f6e789df62e949d57bb8e094e6
SHA512

edf1a8b429d927777169203191ca01dd5f64a7f1064eccee66b6211e48697481f20d34cbb8fad172fa569e68baab6a980d7f475bcbd879b616a1335ecf74d4da

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2500	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2500	AcroRd32.exe
2500	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 2516	1636	cmd.exe	29
PID 1636 wrote to memory of 2516	1636	cmd.exe	29
PID 1636 wrote to memory of 2516	1636	cmd.exe	29
PID 2516 wrote to memory of 2500	2516	rundll32.exe	30
PID 2516 wrote to memory of 2500	2516	rundll32.exe	30
PID 2516 wrote to memory of 2500	2516	rundll32.exe	30
PID 2516 wrote to memory of 2500	2516	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\AntiSpam.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\AntiSpam.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Luna-Grabber-main\options\AntiSpam.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0748306e12fdb5c8933c4af997c7f333

SHA1
442c804b69f9269dd74c1503f260e5bad5fd4c52

SHA256
a0b75811dcd07ffee89b329a22c8b6c4e992a307eed36ce31081d4fbd8b06417

SHA512
dcd05331c979a5a92d677aa1679fb28584b0388729d52bc9379bb4a7e31474f4e488a71b1c279a8921ffb5921023abfd8b5e9d79a3d44ff8c67b8961b9a0ace9

Download Submit