09d4a8614c1ad3205e60e2e401393c673e726822d5acd4255edd65a7f2ec47c9

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 06:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

plugin.video.amazon-test/resources/lib/configs.pyo
Size

1KB
MD5

f7e75bb52d0ab0b2d31a1dbdd5b458dc
SHA1

c041c0ba0e07bb11b81f621db36ac22c084d9529
SHA256

abdb86a6d00f54acc54ca665bb6c10ec160095501fe53592641b4fc3892a3a5e
SHA512

44126d547556115a51fb443046d5bc9767794543fb05645928a36ed1a3157114c05d55dd64f3a0edc4b47835549e912d3a65f039101c6ea1749ded055f2ae9ec

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyo	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.pyo\ = "pyo_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\pyo_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	AcroRd32.exe
2800	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2720	2232	cmd.exe	29
PID 2232 wrote to memory of 2720	2232	cmd.exe	29
PID 2232 wrote to memory of 2720	2232	cmd.exe	29
PID 2720 wrote to memory of 2800	2720	rundll32.exe	30
PID 2720 wrote to memory of 2800	2720	rundll32.exe	30
PID 2720 wrote to memory of 2800	2720	rundll32.exe	30
PID 2720 wrote to memory of 2800	2720	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\plugin.video.amazon-test\resources\lib\configs.pyo
1⤵
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\plugin.video.amazon-test\resources\lib\configs.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\plugin.video.amazon-test\resources\lib\configs.pyo"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b08439f9524435b1dcf0ea63710dca33

SHA1
f9fde5ca627656599061045b69d050617404ed72

SHA256
75f32ab5fc6d3b581d4ef3c6c96d6fc162e55c4fdb860922f96938ffca0907c3

SHA512
969fed60487ef2c7d02ab639a1c5cbc2619471414a22870b478988636db1516db39dc745150efb42c893f2da2f10bf435feae50964978eedd40f8818a0e5442d

Download Submit