18c766006964ed44aa9c82605660ee0c3eefcb577c5a5512b4e040a4e4aadf60

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
24-06-2024 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

87KB
MD5

3aa483959cccc2432773a106815b6835
SHA1

3dd99907ff813b80ba9b659889ed41976b5bc32c
SHA256

5cadfc106c48f62bbc8a202b031a91739523c550c73b44fd1d41f42daa681cc3
SHA512

1d578838e8ec0a645018af73e1415be81426d46a5857fcac07d2fc7fa5a60e1e1cfb79331b3f7ea7540b243597114059dec16d51907f3b27f4a831799a720113
SSDEEP

1536:ZaYCH9czJ+7OF2+4fAIlEONnWDfRtdNvo7cbSQNtdhq09J7Xeql4gxMiLqDx/BM0:8xH9oJ+7r1WDfRtdNv8cbSQNtdhq09J+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2516	2192	cmd.exe	29
PID 2192 wrote to memory of 2516	2192	cmd.exe	29
PID 2192 wrote to memory of 2516	2192	cmd.exe	29
PID 2516 wrote to memory of 2772	2516	rundll32.exe	30
PID 2516 wrote to memory of 2772	2516	rundll32.exe	30
PID 2516 wrote to memory of 2772	2516	rundll32.exe	30
PID 2516 wrote to memory of 2772	2516	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bad2b65ae135057dd3adc5f93c886e6b

SHA1
60915ee5fb033a4ea690cf67f5a3a6c85bada773

SHA256
82f161fe3c20e3fbfd37b0df19c9a77f4c80679969508b7f978e25b25c594e9f

SHA512
fe5d35552955cdd262f9c7eb1557341a512dd0c41daf9c1faf2364b612d6da2d3cf3dbfcc95b73b57e68fd7ef0dedf94587b4d913f1f716eaee8f1f00e6c3219

Download Submit