Resubmissions
20/06/2024, 19:48
240620-yh9bcavcqe20/06/2024, 00:52
240620-a8ebwszcpe1013/06/2024, 04:04
240613-enbsgstdpe10Analysis
- max time kernel
19s - max time network
23s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/06/2024, 00:52
Behavioral task
behavioral1
Sample
source_prepared.pyc
Resource
win7-20240611-en
windows7-x64
4 signatures
150 seconds
General
- Target source_prepared.pyc
- Size 230KB
- Sample240620-a8ebwszcpe
- SHA256 f19c17244067e24e380069f82f94c019d3909e3f1f13b680a343d7dede3541f6
- MD5 73cf7901f8a5dda1df3dada4d667708e
- SHA1 50927e6f25a4e140c446cea25e79abee0586bec4
- SHA512 7e06f445c2768a4acd08e89272fa4b53e2aa466e05a9e7a665250c9448563b00aa044a496a9ea76012809317c256095bbf67d8ba287352f2485dc84f109c1b70
- SSDEEP 3072:X9mYiNJ6YxXdpk9dFEeou8qzXYP/UxpQq1pJqscV8IvdXzSs6Fs:X97iNJ699weoOYP/K60EVQsV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Pysilon 1 IoCs
resource yara_rule behavioral2/files/0x0008000000023425-14.dat pysilon - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings firefox.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings OpenWith.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3952 OpenWith.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 612 firefox.exe Token: SeDebugPrivilege 612 firefox.exe Token: SeDebugPrivilege 612 firefox.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 612 firefox.exe 612 firefox.exe 612 firefox.exe 612 firefox.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 612 firefox.exe 612 firefox.exe 612 firefox.exe - Suspicious use of SetWindowsHookEx 21 IoCs
pid Process 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 3952 OpenWith.exe 612 firefox.exe 612 firefox.exe 612 firefox.exe 612 firefox.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3952 wrote to memory of 2100 3952 OpenWith.exe 88 PID 3952 wrote to memory of 2100 3952 OpenWith.exe 88 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 2100 wrote to memory of 612 2100 firefox.exe 90 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 4840 612 firefox.exe 91 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 PID 612 wrote to memory of 512 612 firefox.exe 92 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc1⤵
- Modifies registry class
PID:3280
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"2⤵
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.0.404668343\2094555607" -parentBuildID 20230214051806 -prefsHandle 1804 -prefMapHandle 1796 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df176a6d-99ec-4fab-a6bf-3e0cfe59c9a9} 612 "\\.\pipe\gecko-crash-server-pipe.612" 1884 233b200b458 gpu4⤵PID:4840
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.1.381912919\1719205863" -parentBuildID 20230214051806 -prefsHandle 2464 -prefMapHandle 2460 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b667db5-efd8-49d5-b6a3-651126c23345} 612 "\\.\pipe\gecko-crash-server-pipe.612" 2476 233a5387b58 socket4⤵PID:512
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.2.1707730574\474009666" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2816 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b5ef2c00-3b88-4fbf-9d7c-12a9acdd15e2} 612 "\\.\pipe\gecko-crash-server-pipe.612" 2880 233b5057458 tab4⤵PID:3296
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.3.657565901\1523496754" -childID 2 -isForBrowser -prefsHandle 4060 -prefMapHandle 4048 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {48dc3cfe-764c-435e-b310-13e7d0cc2beb} 612 "\\.\pipe\gecko-crash-server-pipe.612" 4072 233a5377e58 tab4⤵PID:1652
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.4.767769298\856345562" -childID 3 -isForBrowser -prefsHandle 5172 -prefMapHandle 5152 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4917b7a-7ac8-4cdc-8a3e-57c1b9015dda} 612 "\\.\pipe\gecko-crash-server-pipe.612" 5184 233b8ced258 tab4⤵PID:4484
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.5.587333665\678114220" -childID 4 -isForBrowser -prefsHandle 5424 -prefMapHandle 5420 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5c00fef-4c25-4f35-b7a3-c5421f5cbd62} 612 "\\.\pipe\gecko-crash-server-pipe.612" 5328 233b8e30258 tab4⤵PID:4892
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="612.6.1572171363\787532731" -childID 5 -isForBrowser -prefsHandle 5304 -prefMapHandle 5192 -prefsLen 27692 -prefMapSize 235121 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c556b563-752c-4903-a052-e64256f0de0b} 612 "\\.\pipe\gecko-crash-server-pipe.612" 5200 233b8e32958 tab4⤵PID:2512
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Downloads\6dbU3QLJ.pyc.part
- Size 230KB
- SHA256 f19c17244067e24e380069f82f94c019d3909e3f1f13b680a343d7dede3541f6
- MD5 73cf7901f8a5dda1df3dada4d667708e
- SHA1 50927e6f25a4e140c446cea25e79abee0586bec4
- SHA512 7e06f445c2768a4acd08e89272fa4b53e2aa466e05a9e7a665250c9448563b00aa044a496a9ea76012809317c256095bbf67d8ba287352f2485dc84f109c1b70
- SSDEEP 3072:X9mYiNJ6YxXdpk9dFEeou8qzXYP/UxpQq1pJqscV8IvdXzSs6Fs:X97iNJ699weoOYP/K60EVQsV
- MD5 SHA1 SHA512 SSDEEP