8a9f45044aca163fcdd47e4fc6f4c72cc6e17231b3a467758e641d8a76684109

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 08:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Requirements upwork.scr
Size

699.6MB
MD5

1cbf33e0f9964d14cc107236d8060972
SHA1

bd7052b3f20a83ed7ce837030d7aee6b1150781a
SHA256

b7615563fc08671d442b6f8102eeb61f5058f75821bac5f701385f7c123d7fa5
SHA512

1042f8ee6b23000d55082af3061a8559c266302d5a72eb35041d33a090ec4e70850f7d55df3c3463478d40d0a17f4a1834d9e72a59829041540898d6b4bba63b
SSDEEP

393216:fM07b4unYmNXdJu4LTYi7dRcogr6+7QJhrrXZEwCz:fNIunb9bJRRgrWXZEw0

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

pythonw.exe

pid process

2540 pythonw.exe
Loads dropped DLL 2 IoCs

Processes:

Requirements upwork.scrpythonw.exe

pid process

1500 Requirements upwork.scr
2540 pythonw.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AcroRd32.exe

pid process

2660 AcroRd32.exe
2660 AcroRd32.exe
2660 AcroRd32.exe

pid	process
2540	pythonw.exe

pid	process
1500	Requirements upwork.scr
2540	pythonw.exe

pid	process
2660	AcroRd32.exe

pid	process
2660	AcroRd32.exe
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

Requirements upwork.scr

description	pid	process	target process
PID 1500 wrote to memory of 2540	1500	Requirements upwork.scr	pythonw.exe
PID 1500 wrote to memory of 2540	1500	Requirements upwork.scr	pythonw.exe
PID 1500 wrote to memory of 2540	1500	Requirements upwork.scr	pythonw.exe
PID 1500 wrote to memory of 2660	1500	Requirements upwork.scr	AcroRd32.exe
PID 1500 wrote to memory of 2660	1500	Requirements upwork.scr	AcroRd32.exe
PID 1500 wrote to memory of 2660	1500	Requirements upwork.scr	AcroRd32.exe
PID 1500 wrote to memory of 2660	1500	Requirements upwork.scr	AcroRd32.exe

C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr
"C:\Users\Admin\AppData\Local\Temp\Requirements upwork.scr" /S
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe
  "C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe" /S
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2540
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
401ddc298dbd5aa81e1efd876371abe1

SHA1
583a28595771597be583bf0cc0ff90a814ba0a36

SHA256
ae663a4b2d98b4beb4e91afcb645bc2d15a1545f8b07e1e4b66f7b42e67d0d76

SHA512
ef9878b46f77050a576a470e97fa920cdbd6aaa2e06820e2659324c0e6b419b533154c9e581f8b5b6c9d898ec17efd56442bcce7818f07754a6d6867f8752092

Download Submit
C:\Users\Admin\AppData\Roaming\Programs\WinRAR\pythonw.exe

Filesize
94KB

MD5
9a4cc0d8e7007f7ef20ca585324e0739

SHA1
f3e5a2e477cac4bab85940a2158eed78f2d74441

SHA256
040d121a3179f49cd3f33f4bc998bc8f78b7f560bfd93f279224d69e76a06e92

SHA512
54636a48141804112f5b4f2fc70cb7c959a041e5743aeedb5184091b51daa1d1a03f0016e8299c0d56d924c6c8ae585e4fc864021081ffdf1e6f3eab11dd43b3

Download Submit
C:\Users\Admin\AppData\Roaming\Temp\Requirements.pdf

Filesize
717KB

MD5
720b78ca59dbb0e1b885f47b9c4eebd3

SHA1
98629bc8c27329023931d158d2ab879e8136b5ff

SHA256
73300eda96e39870895468cf7a7b90616b37d5d7673671c89db1776c192ed2be

SHA512
ee22206441b41881acbae939dba2f4269e652782ba485963f81d3ae2aedd3838bba2a673de502a367cdc5f1a8c33a08e120495a473d617f2ec049fa5f0be17ac

Download Submit
\Users\Admin\AppData\Roaming\Programs\WinRAR\python310.dll

Filesize
4.3MB

MD5
8fbbe41173ae011a717c706f25d06121

SHA1
db35f1d1a0916cc0732b9747bd67a37e827440aa

SHA256
ccd635f18a955d0d6bec012be96de876bb2009ff522c3457df40792405637a5a

SHA512
8a17ecd7545ccee3bba62df2c5a00b839f60e0009fa55d9c9d8cc962349a501c618d65f83de2a977bda9b4368224f6ea89a881478d58fa4b68a9891b998d985a

Download Submit