62b817f3eb0070a4e35351f09bdd9d65bafe27f43f5b82a84274fcaa8cb72cfc

Analysis

max time kernel
359s
max time network
363s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedditVideoMakerBot-3.2.1/TTS/GTTS.py
Size 443B
Sample240615-settlaydmj
SHA256 9680758aa7768423135ab0aa844e7cebe4bdf954716f8c37da70bf29ca3f112a
MD5 2c48b31a6df6c0041e9c993f4917667e
SHA1 3ee3c5b5469b9a2bbe402db8932cc5e01757eeea
SHA512 ee427d616b0df037ccf0e658c4b8857b332fd72b2a6c2d46f616c59c333124b53619fcd258f8544ad54563e8a3fde61bbb230900838a9e5869ccaa665f39a629
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2816	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2816	AcroRd32.exe
2816	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2640	2436	cmd.exe	29
PID 2436 wrote to memory of 2640	2436	cmd.exe	29
PID 2436 wrote to memory of 2640	2436	cmd.exe	29
PID 2640 wrote to memory of 2816	2640	rundll32.exe	30
PID 2640 wrote to memory of 2816	2640	rundll32.exe	30
PID 2640 wrote to memory of 2816	2640	rundll32.exe	30
PID 2640 wrote to memory of 2816	2640	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\GTTS.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\GTTS.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\GTTS.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 06fc04104c1a3546d8b3dafa3adaf457f2b3b870c449fc363c20b4efaf3a3cc6
MD5 147ad1f292416d114184b843d20c4bf4
SHA1 23a10f7d357534d19e8d442fb058fac88a756b88
SHA512 d2ef35b13791123836e4df04737bc13137906746ca5970995af86eede60cb31cf834163dc6fb794003ce0b4f2c7c622bb56c92c54b36b7cf540a5e9f1046b31c
MD5 SHA1 SHA512

Submit Download