7d551f3ea29e98532930d0be830e104dda0b2de79626a5ccea056b5daff755e1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 01:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cscpt.pyc
Size 3KB
Sample240620-bnst8a1aqa
SHA256 3a179de32cb977b2d1068deed6abd7ce8b8855409f3340f9c44b4ed6d6c2764e
MD5 6d460ee61d36b640775287551b1ebc31
SHA1 98ab9ef5973eae0aea9333ccf7dc4124c0d55681
SHA512 7bf2aa538a5adf7b21ca10a1257955adf80449064d5da3fcc8d097b1c86286c46b7c88f3fb2a6c77c68698536d60874f271f3267014316ce67abc7ab1426511a
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2588	2856	cmd.exe	29
PID 2856 wrote to memory of 2588	2856	cmd.exe	29
PID 2856 wrote to memory of 2588	2856	cmd.exe	29
PID 2588 wrote to memory of 2680	2588	rundll32.exe	30
PID 2588 wrote to memory of 2680	2588	rundll32.exe	30
PID 2588 wrote to memory of 2680	2588	rundll32.exe	30
PID 2588 wrote to memory of 2680	2588	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cscpt.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cscpt.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2588
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\cscpt.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 3ed55d148b7c816e41ee5cd603df61bee59c4e8e029eff000d5157b834f71eff
MD5 45abc4256392567afc71233491ae7c8d
SHA1 e6f181070bba41b11cdbe2c88f515ea2c403d9a6
SHA512 a2dd2c1cb1dc1f56f378c9644960881783f25a9cb06f0415c91a65da20c370afde29a63cf7448cb8471956f132ebb6f533960be54f8e395c1fdc19d800f3715c
MD5 SHA1 SHA512

Submit Download