Analysis

  • max time kernel
    121s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21-06-2024 19:51

General

  • Target

    AKUMA/__pycache__/deanon.cpython-311.pyc

  • Size

    4KB

  • MD5

    8611d958e26515bb77cc5817c0ae3f12

  • SHA1

    4e5b6eaa859a9017860b6b8be6537133033bff0f

  • SHA256

    8dd45c85dfac18dd5164f9f91ee146ccfb668c11f7ad936fbf1b7fca332fdde6

  • SHA512

    01be08d231f0c8200901eb73db2f17d090ecb601aa10cd80b021d91a369374e79d26b6a552d5c187f6653695a260b35af87a2cd85b238e37acec9dcb02584e54

  • SSDEEP

    96:Yiz29HQ5/h9ECtTAtz/D7vKeliNiiiiiHiijTBvb7hjBDjU1ZG:Yiz2AJ9pMznKe1T5b7l61Q

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-311.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-311.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\AKUMA\__pycache__\deanon.cpython-311.pyc"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2544

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
    Filesize

    3KB

    MD5

    d32abae068a5be7a39e8890c1ecce3ab

    SHA1

    7cd93bcb75eb131e051f7f211516d2a8ba500a2f

    SHA256

    85a663c7ebd1189424ee8ea23c80d2fe55df8a8da57cca5a3906a864eb5bde10

    SHA512

    54a7948570d537a6b81f32361d41bc4d3f838348805a21af702c9f407c8ab6562557b8b3badf043235a1364c0c7f3d51c8fff6f700dcf05dd8b63066adad552c