62b817f3eb0070a4e35351f09bdd9d65bafe27f43f5b82a84274fcaa8cb72cfc

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedditVideoMakerBot-3.2.1/TTS/aws_polly.py
Size 2KB
Sample240615-settlaydmj
SHA256 6ee63f7041767b207ba7f8dd65bff8fe097698d6790c6dbaf9a1d1133fb205e3
MD5 942e9523d9c4a594ffb4c89eb55a1841
SHA1 87773f41b7d2f2fe26925bf4ab56eebc2849d873
SHA512 155a618ef3e20b9967f8fe43e156dd7421c48c745ca6f1c109dcc904e84131853290e89fb24f2befb3f10a23c10cebd1cc0863f744a4de3ed880f2ed87fd2437
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2584	2764	cmd.exe	29
PID 2764 wrote to memory of 2584	2764	cmd.exe	29
PID 2764 wrote to memory of 2584	2764	cmd.exe	29
PID 2584 wrote to memory of 2712	2584	rundll32.exe	30
PID 2584 wrote to memory of 2712	2584	rundll32.exe	30
PID 2584 wrote to memory of 2712	2584	rundll32.exe	30
PID 2584 wrote to memory of 2712	2584	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\aws_polly.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\aws_polly.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\aws_polly.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 5ae2f12061cbbf1c76cda3ed589ffa0cd44a1f78aa4c956cba3b92e5cad08f36
MD5 8959936c61f32460f47788a90cb8978c
SHA1 67fd73e1d4992f6d10a8a5fb828a4322bba3e7f9
SHA512 45597adfb77f3607624883228448c9c6d67df82545a1885229904033839381847ea802911f4d574e052905b990ca10cc68b033e99b1fb08ee59c936f38fcb43b
MD5 SHA1 SHA512

Submit Download