c9ca69b4886464e1dc0a0879bf2843d1b4d44fb9c42b410459b50835c1dea8af

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 11:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
xx.pyc
Size 72KB
Sample240615-nvgrratalk
SHA256 0b218de0eb6ba975d4392ae039c984ac6f4fe24c1a7dd2d0eeb560879ffd8781
MD5 5edc698412a98b48d86e14152543f396
SHA1 1ee67bc2e9d2e6bf3de3057ce08bf04973fb35f8
SHA512 59dc5081da75f03af76d4deda1404aeb34e6c17bf463710b13977af3426d78d450cda98dae9985e201ae851ed125c937366398a7bc22c1541308e9cb7c11a9fe
SSDEEP 1536:36TWr0SzYPQlWXV2IsBORbHBwFRuTg8DyKEgR2eJ:3DOv2IsBeWFRuhDyKEgRx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2664	1924	cmd.exe	29
PID 1924 wrote to memory of 2664	1924	cmd.exe	29
PID 1924 wrote to memory of 2664	1924	cmd.exe	29
PID 2664 wrote to memory of 3000	2664	rundll32.exe	30
PID 2664 wrote to memory of 3000	2664	rundll32.exe	30
PID 2664 wrote to memory of 3000	2664	rundll32.exe	30
PID 2664 wrote to memory of 3000	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\xx.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\xx.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\xx.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 8451dcc53babe6428eab4527d0506800e99b7d4f80f594e52c7015ee75076b71
MD5 6be60f335322fd6e260b6178f74e2ac3
SHA1 4d999800e9a659ac8839e992296ccd9c6849e0c7
SHA512 4516d7d25e753d017cb3312bf2da09adf484161b60a3d2f7499dcb1a4c5d9a356d9af9cc68c5f26b7680e4ba0a1dce2e5c628989f0c2eceafe19baac01e91085
MD5 SHA1 SHA512

Submit Download