1d9d9fa887c5b9e5b6c6aebca3a3cd601ef17dd9e97ae2b95cdbad0c3963f66b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cantdeleteme.py
Size

305KB
MD5

230a6f05ac8001a67cbf5172a025cd73
SHA1

834aff2b40d67395dfe53ceaee485d3f4d7b43d8
SHA256

1d9d9fa887c5b9e5b6c6aebca3a3cd601ef17dd9e97ae2b95cdbad0c3963f66b
SHA512

82746706fcdcd280e4248130be3c7a6ec17c429e9f837df386a4f98fe5cd0cc39eb2465602dda11596e59897f2a4dafa2a19678eb78f1870306fd0a295cb5069
SSDEEP

6144:sGKDDjq6qOot3n5fdVVnFwMJZEPKZ1NijnMgNCdnJyvLpw8:sGKDDeDOS5fn7eMLdne

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 2716	3008	cmd.exe	29
PID 3008 wrote to memory of 2716	3008	cmd.exe	29
PID 3008 wrote to memory of 2716	3008	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\cantdeleteme.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\cantdeleteme.py
  2⤵
  - Modifies registry class
  PID:2716

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...