546f0ebe2916392dea3ceb580ec5d7569fe8bd465a9a16b40a080b2f61d31482

Analysis

max time kernel
1563s
max time network
1563s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
20-06-2024 17:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

checker.py
Size

3KB
MD5

c00e65ba78be2392277dfa15b0b5d20b
SHA1

2b3d0de55b8b73210c57ac2201fa5c2c840ce377
SHA256

f3f31ec5ce1a8d9cb25ffcb111636095a11c880f99c06bb2e987a37ab955ee39
SHA512

fc0fabf2b39d11fbb12bacf37bb9f24d7de592282c90f6718b951904376279261c377a176cb4240e230ac0443337c3ae356c4f61c5e47b07f13547d1dea75456

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2388 AcroRd32.exe
2388 AcroRd32.exe

pid	process
2388	AcroRd32.exe

pid	process
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2916 wrote to memory of 2628	2916	cmd.exe	rundll32.exe
PID 2916 wrote to memory of 2628	2916	cmd.exe	rundll32.exe
PID 2916 wrote to memory of 2628	2916	cmd.exe	rundll32.exe
PID 2628 wrote to memory of 2388	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2388	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2388	2628	rundll32.exe	AcroRd32.exe
PID 2628 wrote to memory of 2388	2628	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\checker.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2916

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\checker.py
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2628

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\checker.py"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2388

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
8c73d50ee19a30a8f2391aef3b82476e

SHA1
05cb6922a22752cb464307bcfb3270d8af7ab18a

SHA256
271f0d83b0fb4631a3fbd2c18f8b53161236f91b8a663ffaf48a69d0d6e23da0

SHA512
220ee78f416a583f7093d6ac7b7d546c26dd06992b7a0e1175ab2a69ff7d827662764175d7fecda64cdeb863abb63ea04ecd07dc43a86f669c4e7a69810165d9

Download Submit