2ac633521283d233a8478547cb6f8109c6f318a1b0c8e9f822833b5c74c12b39

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
19/06/2024, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WindowsLibrary.pyc
Size 29KB
Sample240619-v4kckazelp
SHA256 e33f3b2997d0710dbeeebad40c77fc21f58f61c6c21cebb8776f0069a0379ad3
MD5 7b3f5e57516c8db5e6b96208fb77a61e
SHA1 eb77ed510e62ce35b3f292da2533d480000c1a38
SHA512 17820fced58e8e7e4ecc3912c871a42ce84a53e28b3d2bf8627a8184f773227c59fe062fc991db5608434fae10f69f9b1cf78322551feafcaf6c0513598b269a
SSDEEP 768:0wOR/Jt4/VZQUuS2JO0r8ZekDjpTXFDQSGx5JY2:0w0c/VCS247ekDJzGx5T
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2736	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2736	AcroRd32.exe
2736	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2616	3064	cmd.exe	29
PID 3064 wrote to memory of 2616	3064	cmd.exe	29
PID 3064 wrote to memory of 2616	3064	cmd.exe	29
PID 2616 wrote to memory of 2736	2616	rundll32.exe	30
PID 2616 wrote to memory of 2736	2616	rundll32.exe	30
PID 2616 wrote to memory of 2736	2616	rundll32.exe	30
PID 2616 wrote to memory of 2736	2616	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WindowsLibrary.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WindowsLibrary.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsLibrary.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 cda401693af12c180b7084377a2fb40842d767c45bc6ae4a8f2016463f3da6df
MD5 a6c135038c1eaa4a5df18d5ef68625eb
SHA1 e302f81d802bce1ff718aa765a4a7106453f9dc2
SHA512 b4e2a3a0aa766555c512151bc5ed2ec00d6ebe70dc9b414986589c0405330022a3b970e664e801544be08221fe5a07b00ad054a47bb1dff8cb23efb91a82e153
MD5 SHA1 SHA512

Submit Download