Resubmissions

10/06/2024, 13:26 UTC

240610-qpxbcsxbra 8

10/06/2024, 13:22 UTC

240610-qmq2kaxfll 8

10/06/2024, 13:16 UTC

240610-qh9m4swhle 8

Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 13:16 UTC

General

  • Target

    PySilon-malware-main/resources/source_code/audio_control.py

  • Size

    3KB

  • MD5

    6a760b020cd268cbb98d75c56a8a4862

  • SHA1

    42361cb81b705d959c6d4107397f675467531446

  • SHA256

    adc2207e1c6b83eb6dabb2963f1f518e7b469394871b70688c7acd26df115a92

  • SHA512

    a95a174012ae155a1643e1d6f6333a3dbb9b5398c39602fb53ec0c5eebcb140c0b128477a23e01debe6fcfefb9b1bf8e5c1784404d0f1b44a1cf59b55f00a8b2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\audio_control.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\audio_control.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\PySilon-malware-main\resources\source_code\audio_control.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    1b21021cb22efb61c5bf8c893e90f6f1

    SHA1

    8cdf350c3e78e25f1adc140133794839b5cced54

    SHA256

    834c51309172a3d17600e52a2324fba40cac8c7bf6c1c4b59cb461001f471a74

    SHA512

    a1ef6edda6fafd70aea6975ab5dcc13c8ca6fd72e5978c30cd05e56cbc072c060d2d69852d04bdacae69c1d722340bca083394c8bc6a55d6f1240016c7da9a4e

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.