619739e4769781798b4786fb9cae2fa31a4b99d55ea98cbabddca454aa3e92f6

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cinerotique_mod_scripts/objects_handling.pyc
Size

1KB
MD5

367467dc9fcc4bdc8d7117f81043d704
SHA1

b9a1d25a70fdd0cc750c69d9ce695d146b115a95
SHA256

4273b968d7262cd71c9c33b74d0506472191d42cf05cd4c84aba99b35064ffb5
SHA512

6e9fc3855c7e545918c45492590ac3aa804f81b13e370d4f4502408862c39a117ffab0717cef8e33e5051a47a013ab10250942045028677611dc83ff20087fd8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2220	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2220	AcroRd32.exe
2220	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2676	2908	cmd.exe	29
PID 2908 wrote to memory of 2676	2908	cmd.exe	29
PID 2908 wrote to memory of 2676	2908	cmd.exe	29
PID 2676 wrote to memory of 2220	2676	rundll32.exe	30
PID 2676 wrote to memory of 2220	2676	rundll32.exe	30
PID 2676 wrote to memory of 2220	2676	rundll32.exe	30
PID 2676 wrote to memory of 2220	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\objects_handling.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\objects_handling.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cinerotique_mod_scripts\objects_handling.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c2f16028480c36d8cb3ca229b0dcad1c

SHA1
346b15bfb124626b0ce492a02b0bfef6458c7992

SHA256
a67a21a0d6256291c7b9173848992597bed2678cb0a516a0c8e6e46b72df1f32

SHA512
56ff231f42394c3a19634c8ab19840654e7db671577b124db045439d51404b3cb1d6af3c33b1e2de2da7b271d83c6862840c91f05d39e32791822692a982b0b9

Download Submit