Overview
overview
7Static
static
3ugene-50.0...64.exe
windows7-x64
4ugene-50.0...64.exe
windows10-2004-x64
7tools/pyth...loc.py
windows7-x64
3tools/pyth...loc.py
windows10-2004-x64
3tools/pyth...tty.py
windows7-x64
3tools/pyth...tty.py
windows10-2004-x64
3tools/pyth...tle.py
windows7-x64
3tools/pyth...tle.py
windows10-2004-x64
3tools/pyth...pes.py
windows7-x64
3tools/pyth...pes.py
windows10-2004-x64
3tools/pyth...ing.py
windows7-x64
3tools/pyth...ing.py
windows10-2004-x64
3tools/pyth.../uu.py
windows7-x64
3tools/pyth.../uu.py
windows10-2004-x64
3tools/pyth...uid.py
windows7-x64
3tools/pyth...uid.py
windows10-2004-x64
3tools/pyth...ngs.py
windows7-x64
3tools/pyth...ngs.py
windows10-2004-x64
3tools/pyth...ave.py
windows7-x64
3tools/pyth...ave.py
windows10-2004-x64
3tools/pyth...ref.py
windows7-x64
3tools/pyth...ref.py
windows10-2004-x64
3tools/pyth...WS.txt
windows7-x64
1tools/pyth...WS.txt
windows10-2004-x64
1tools/pyth...on.exe
windows7-x64
1tools/pyth...on.exe
windows10-2004-x64
1tools/pyth...n3.dll
windows7-x64
1tools/pyth...n3.dll
windows10-2004-x64
1tools/pyth...12.dll
windows7-x64
1tools/pyth...12.dll
windows10-2004-x64
1tools/pyth...nw.exe
windows7-x64
1tools/pyth...nw.exe
windows10-2004-x64
1Analysis
-
max time kernel
599s -
max time network
617s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 13:16
Static task
static1
Behavioral task
behavioral1
Sample
ugene-50.0-win-x86-64.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ugene-50.0-win-x86-64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
tools/python3/Lib/tracemalloc.py
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
tools/python3/Lib/tracemalloc.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
tools/python3/Lib/tty.py
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
tools/python3/Lib/tty.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
tools/python3/Lib/turtle.py
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tools/python3/Lib/turtle.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
tools/python3/Lib/types.py
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
tools/python3/Lib/types.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
tools/python3/Lib/typing.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
tools/python3/Lib/typing.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
tools/python3/Lib/uu.py
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
tools/python3/Lib/uu.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
tools/python3/Lib/uuid.py
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
tools/python3/Lib/uuid.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
tools/python3/Lib/warnings.py
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
tools/python3/Lib/warnings.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
tools/python3/Lib/wave.py
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
tools/python3/Lib/wave.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
tools/python3/Lib/weakref.py
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
tools/python3/Lib/weakref.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
tools/python3/NEWS.txt
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
tools/python3/NEWS.txt
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
tools/python3/python.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
tools/python3/python.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
tools/python3/python3.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
tools/python3/python3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
tools/python3/python312.dll
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
tools/python3/python312.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
tools/python3/pythonw.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
tools/python3/pythonw.exe
Resource
win10v2004-20240611-en
General
-
Target
tools/python3/Lib/uu.py
-
Size
7KB
-
MD5
a15408c95a7d73c841df85df469c7a61
-
SHA1
a4fcecb170fb1bc4837c767a048ea32fb7ade876
-
SHA256
f07a806a3327e5df84bca976ea10f0c72d30c36d6169e3815935c5d9c7c67f4f
-
SHA512
ef9627423910f87cd5aa6c87c4ff650e1623f950bfd79bb91e872625d31d88f48b2483c5dc9bd779a8eefb5a59e7f23e54d2f09490e3a473540dc328c3047218
-
SSDEEP
96:IqFD4C1j1e5e65PAKhQ3E2Q/N56npYv9EVBDgcDrWXSONFhnlO7c0pz:1zj1Qe8PAKQEH/6nSVEVORe7c0pz
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2824 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2824 AcroRd32.exe 2824 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2992 wrote to memory of 2784 2992 cmd.exe rundll32.exe PID 2992 wrote to memory of 2784 2992 cmd.exe rundll32.exe PID 2992 wrote to memory of 2784 2992 cmd.exe rundll32.exe PID 2784 wrote to memory of 2824 2784 rundll32.exe AcroRd32.exe PID 2784 wrote to memory of 2824 2784 rundll32.exe AcroRd32.exe PID 2784 wrote to memory of 2824 2784 rundll32.exe AcroRd32.exe PID 2784 wrote to memory of 2824 2784 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py1⤵
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2824
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5fbd39024e7a999e7ddac2ce46e8a9a27
SHA16e47ff6ba79bef500208169b1b4eeb4955b86ce6
SHA256e376cc6860041f6bf8e4cd959d347dd4a1858940c97d94331849e4f481d551b8
SHA512921e45466e4d743261dafeea1cfcccedda46e22be239a63e6b3b0929201c6a20787999cea1ec9aaaf6ccc427e0ccf519ba49cee81deb5c7700a76ede9a41fb65