Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    19/06/2024, 16:40

General

  • Target

    trichloromethane.exe-Malware-main/trichloromethane/PayloadMBR/Programs/png2bin.py

  • Size

    1KB

  • MD5

    32dfd28117b185e4870eaf506bb38af7

  • SHA1

    b3f3572f0f4403d90889ee5cae7f0774759a1328

  • SHA256

    f12bf9386320e3bf1419cc0227430d86c280d40a855b35aff36939f0396b11c7

  • SHA512

    247b2ab09495f1a596bfcd567df5a39742591164b1472fd5e6c13d02dbcef0906212a8c06ddfdc8233e11af01cbf8b32536fff1550d7dc7599153d55edcf974d

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2276
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\trichloromethane.exe-Malware-main\trichloromethane\PayloadMBR\Programs\png2bin.py"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2636

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    ef43270828b9ab91295de64ece1c4594

    SHA1

    db0a83979aadea04461494d87760974694cf3763

    SHA256

    2bf07aabbe1d1723b617a6331eef35114b19f8ac6b4e304ebe1db3c43aafe7bf

    SHA512

    c19563df5428aae85a1149fb79776db8048531b8c011754de1de21eb6662a7965cf05de7eaf8932a973e7767805739eb0cfbea3270709a346af5882cf47effb8