62b817f3eb0070a4e35351f09bdd9d65bafe27f43f5b82a84274fcaa8cb72cfc

Analysis

max time kernel
359s
max time network
360s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RedditVideoMakerBot-3.2.1/TTS/streamlabs_polly.py
Size 1KB
Sample240615-settlaydmj
SHA256 538ef48fc90c88ca8ab9127b7989c59a75a3b33f901c97ab55b58ab00ceeef11
MD5 83c4181567bb19203cd7d8bb121d8041
SHA1 fccac9facf4536fefc4201124712f561e01adc48
SHA512 a62ef76c96636fe55396aa9ee27621c3bf3ecadf3a353d3ac443db4c4d814e862c6e530fb6408c4b217d8a185345108b2e69068b51e263cfd3d38c0f1691104c
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2256	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2256	AcroRd32.exe
2256	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2756	1440	cmd.exe	29
PID 1440 wrote to memory of 2756	1440	cmd.exe	29
PID 1440 wrote to memory of 2756	1440	cmd.exe	29
PID 2756 wrote to memory of 2256	2756	rundll32.exe	30
PID 2756 wrote to memory of 2256	2756	rundll32.exe	30
PID 2756 wrote to memory of 2256	2756	rundll32.exe	30
PID 2756 wrote to memory of 2256	2756	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\streamlabs_polly.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\streamlabs_polly.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RedditVideoMakerBot-3.2.1\TTS\streamlabs_polly.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 b8293ef6e7f55574abb4de8d119fae1d5b98ec45fbd65a93a39d62269b495554
MD5 7779ed9db6387bce9dbdea409c5bc034
SHA1 5ed93e4689f3ca84b2b3c54f858a51efb25bd4fb
SHA512 45b7ba690787de11ac46d4d8f8cb0e898537ac2e56d4b29adb2191441e4d6598ee04c067d18e4ea21ded9dc3386ac6b256fe19b088f576f1c25c472bb2cb77bc
MD5 SHA1 SHA512

Submit Download