Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-06-2024 14:29
Behavioral task
behavioral1
Sample
massdm_1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
massdm_1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
massdm.pyc
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
massdm.pyc
Resource
win10v2004-20240508-en
General
-
Target
massdm.pyc
-
Size
1023B
-
MD5
2fecf336a96e83cf3f00e15e49cef8eb
-
SHA1
0a2086885d43b3a06fcaefdeebdc40f0776c42ea
-
SHA256
13888a91a665df05df33bcc8c4b333cd4d54bd6c1e1cfd9d05c8a799ea331517
-
SHA512
504691d0183ee8c03f0f4cde538df3a7cb2d6e29094fe1b01bc9a17dea98363f81648cd5559bbb9837819d19b611ad3fd0c982cfe47492b96fe76d71f030141f
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\pyc_auto_file\ rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 1048 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 1048 AcroRd32.exe 1048 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1584 wrote to memory of 2896 1584 cmd.exe rundll32.exe PID 1584 wrote to memory of 2896 1584 cmd.exe rundll32.exe PID 1584 wrote to memory of 2896 1584 cmd.exe rundll32.exe PID 2896 wrote to memory of 1048 2896 rundll32.exe AcroRd32.exe PID 2896 wrote to memory of 1048 2896 rundll32.exe AcroRd32.exe PID 2896 wrote to memory of 1048 2896 rundll32.exe AcroRd32.exe PID 2896 wrote to memory of 1048 2896 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\massdm.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\massdm.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\massdm.pyc"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5667b8e2e7ea8eb357ae58731528bc86a
SHA19fe163fb8158c7fd32cc39bf7e2c2be5e69ea95f
SHA25616fd312507ef673fad5d5e2b910cd535684080aee2f5628e1c50f9594026ca1a
SHA512caf35869e86a1ff8d06278ad756dea5bb97a1ffe7967aee1080ebd4f9a884359be4990f675eeda6b6b1d968a7c0167300f9c0df68a1afc4bb2a683cfdc423e92