563c5f0ef4b8403e4a933931ee762b428fe1d6b229d452a1d5397f050393f4b5

Analysis

max time kernel
120s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/06/2024, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
space_keysys.pyc
Size 3KB
Sample240616-xc49rssdqf
SHA256 49116d708c6e67620209bc0ec61fa71f288eeab42e0605db3ebefae2f682bf7f
MD5 fe667bdae50b26a2be8008e2c4dd253a
SHA1 5de21ad240aee05c250178d140dbed5c689489f8
SHA512 4bc6e13377cec8fde7ba36be4416c9113993276eb44306986b9676e4fb98cc2c255ed6d058793c8d178510046cbee6b3086e7c60cd3e0334736b481485bbdee5
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2632	2492	cmd.exe	29
PID 2492 wrote to memory of 2632	2492	cmd.exe	29
PID 2492 wrote to memory of 2632	2492	cmd.exe	29
PID 2632 wrote to memory of 2580	2632	rundll32.exe	30
PID 2632 wrote to memory of 2580	2632	rundll32.exe	30
PID 2632 wrote to memory of 2580	2632	rundll32.exe	30
PID 2632 wrote to memory of 2580	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\space_keysys.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\space_keysys.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\space_keysys.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 2604d1e40f3464acb8301f1a30da674b06a112a526b173d60a50ee46942c3f01
MD5 1f6590160b89c5e9c2b6babfa7a1c2a0
SHA1 8194cbf66ef231b8c0ab20e6f67cefc140a05580
SHA512 aecd85f6e204df3b3b867ab7a910a567fc942d968fa3505eb816ae300880a0637666b5f604c390cd96d4ee3578244084a891dcf558722ce56008b01723f0c5c1
MD5 SHA1 SHA512

Submit Download