9567a8364357429d5a63544a9ee71ad1e51ef27e567e01f51d690cac7e750e18

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Skiioh 0 delay.bat.pyc
Size 40KB
Sample240609-bdqbcabg82
SHA256 9c9f368f8d6c92ffc079018e87d171300c9710b0836667eac272203600c9bb7c
MD5 eeb30578e29c763f7daf9395feb76a21
SHA1 2dbde7e9a835ca02e11e6209f1ba90bbe5790661
SHA512 6f4515ce524fada02a2fac6207b5f884997a1393384e90d502c14f45d3907427cc90389c755d81db0066c19d70aa42083a1e21248c89e1ebb66d9d1f1d213378
SSDEEP 768:7FGYfX/18cTiTlC66aEBfMXvfsiBttbMsnjqmnrD/4mq:3X/ScHWkiBt95eQrC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 2684	2244	cmd.exe	29
PID 2244 wrote to memory of 2684	2244	cmd.exe	29
PID 2244 wrote to memory of 2684	2244	cmd.exe	29
PID 2684 wrote to memory of 2892	2684	rundll32.exe	30
PID 2684 wrote to memory of 2892	2684	rundll32.exe	30
PID 2684 wrote to memory of 2892	2684	rundll32.exe	30
PID 2684 wrote to memory of 2892	2684	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Skiioh 0 delay.bat.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Skiioh 0 delay.bat.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Skiioh 0 delay.bat.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 513d8bbc40e3fd39904a8048e633011cf6f754ff36b4bd34ab87cd8f86a1b1c5
MD5 f184c328dc97fbf8580370b8a201dc84
SHA1 d01c1b25c393f421a3cf21f354b0d336d20f3300
SHA512 d80cab6074f8526ddafddc536f97a6841c36b2be3d9b59a2f01b2420637abf0c0c3ba707db0c719d5bf2191027339471942d1694afd5ca8a24619e78b0074d0e
MD5 SHA1 SHA512

Submit Download