Overview
overview
7Static
static
3ugene-50.0...64.exe
windows7-x64
4ugene-50.0...64.exe
windows10-2004-x64
7tools/pyth...loc.py
windows7-x64
3tools/pyth...loc.py
windows10-2004-x64
3tools/pyth...tty.py
windows7-x64
3tools/pyth...tty.py
windows10-2004-x64
3tools/pyth...tle.py
windows7-x64
3tools/pyth...tle.py
windows10-2004-x64
3tools/pyth...pes.py
windows7-x64
3tools/pyth...pes.py
windows10-2004-x64
3tools/pyth...ing.py
windows7-x64
3tools/pyth...ing.py
windows10-2004-x64
3tools/pyth.../uu.py
windows7-x64
3tools/pyth.../uu.py
windows10-2004-x64
3tools/pyth...uid.py
windows7-x64
3tools/pyth...uid.py
windows10-2004-x64
3tools/pyth...ngs.py
windows7-x64
3tools/pyth...ngs.py
windows10-2004-x64
3tools/pyth...ave.py
windows7-x64
3tools/pyth...ave.py
windows10-2004-x64
3tools/pyth...ref.py
windows7-x64
3tools/pyth...ref.py
windows10-2004-x64
3tools/pyth...WS.txt
windows7-x64
1tools/pyth...WS.txt
windows10-2004-x64
1tools/pyth...on.exe
windows7-x64
1tools/pyth...on.exe
windows10-2004-x64
1tools/pyth...n3.dll
windows7-x64
1tools/pyth...n3.dll
windows10-2004-x64
1tools/pyth...12.dll
windows7-x64
1tools/pyth...12.dll
windows10-2004-x64
1tools/pyth...nw.exe
windows7-x64
1tools/pyth...nw.exe
windows10-2004-x64
1Analysis
-
max time kernel
596s -
max time network
616s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 13:16
Static task
static1
Behavioral task
behavioral1
Sample
ugene-50.0-win-x86-64.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
ugene-50.0-win-x86-64.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
tools/python3/Lib/tracemalloc.py
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
tools/python3/Lib/tracemalloc.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral5
Sample
tools/python3/Lib/tty.py
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
tools/python3/Lib/tty.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
tools/python3/Lib/turtle.py
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
tools/python3/Lib/turtle.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
tools/python3/Lib/types.py
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
tools/python3/Lib/types.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
tools/python3/Lib/typing.py
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
tools/python3/Lib/typing.py
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
tools/python3/Lib/uu.py
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
tools/python3/Lib/uu.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
tools/python3/Lib/uuid.py
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
tools/python3/Lib/uuid.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
tools/python3/Lib/warnings.py
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
tools/python3/Lib/warnings.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
tools/python3/Lib/wave.py
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
tools/python3/Lib/wave.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
tools/python3/Lib/weakref.py
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
tools/python3/Lib/weakref.py
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
tools/python3/NEWS.txt
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
tools/python3/NEWS.txt
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
tools/python3/python.exe
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
tools/python3/python.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
tools/python3/python3.dll
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
tools/python3/python3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
tools/python3/python312.dll
Resource
win7-20240508-en
Behavioral task
behavioral30
Sample
tools/python3/python312.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
tools/python3/pythonw.exe
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
tools/python3/pythonw.exe
Resource
win10v2004-20240611-en
General
-
Target
tools/python3/Lib/types.py
-
Size
11KB
-
MD5
8303d9715c8089a5633f874f714643a7
-
SHA1
cdb53427ca74d3682a666b83f883b832b2c9c9f4
-
SHA256
d7ce485ecd8d4d1531d8f710e538b4d1a49378afacb6ff9231e48c645a9fa95e
-
SHA512
1a6ca272dde77bc4d133244047fcc821ffcb3adee89d400fe99ece9cf18ab566732d48df2f18f542b228b73b3402a3cace3cd91a9e2b9480b51f7e5e598d3615
-
SSDEEP
192:RYevVSyy+zNVWPfeSu6r/OKi+VfTQJWD4GqwfAE9UYzaSaVDYG1XVz6:RYuLDzHWPm3l4faW8RwLaVDZ1XV+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2468 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2468 AcroRd32.exe 2468 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 2132 wrote to memory of 2636 2132 cmd.exe rundll32.exe PID 2132 wrote to memory of 2636 2132 cmd.exe rundll32.exe PID 2132 wrote to memory of 2636 2132 cmd.exe rundll32.exe PID 2636 wrote to memory of 2468 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2468 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2468 2636 rundll32.exe AcroRd32.exe PID 2636 wrote to memory of 2468 2636 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py1⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5d1f10ba15248880b20fc9dfb474b82a5
SHA1cc3c6475df573df7171f0c147aebc734ab6cc841
SHA256b8c5956af8fee13bd0e309fd7ae6a9dfa77099fd0a4d5563d2d9d037759f7087
SHA51211e15156ff4cdb5c200f3c3bf0a2209366269d101afdc48571a1103e3e9cc91ece89c1670b1de6068bea3921e4e69983c3be6f334e3ed5b1aea29cf7ea2b6af1