d88e7a747d4889013c3b2eea2a99d28f4a559d8801296906476d8475a1967fda

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 20:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Lang/lang.py
Size

7KB
MD5

0d6eb5982e1284fc4c78a6e74af508b3
SHA1

39734a0b785801afe7dab44e9619f5e75c55bad3
SHA256

af1dba2252276d6b8cf33047782d02025fa05a10e3ce0642a2f70512be3a7f66
SHA512

be6f30b3475e741fd8afd032dc2759b0b8c82936078fddab45418564366cb468d9b0d8924347251ed5929dc67b7b28daa0e7f6d9030e6b92a72acf7f2faae812
SSDEEP

192:tG89DMH5GFq/3CUVd6JwS+nW/Ot/2QcZ/V/w/Ze:tlBMH5GFyCUH+X+pAQcce

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 2676	1912	cmd.exe	29
PID 1912 wrote to memory of 2676	1912	cmd.exe	29
PID 1912 wrote to memory of 2676	1912	cmd.exe	29
PID 2676 wrote to memory of 2660	2676	rundll32.exe	30
PID 2676 wrote to memory of 2660	2676	rundll32.exe	30
PID 2676 wrote to memory of 2660	2676	rundll32.exe	30
PID 2676 wrote to memory of 2660	2676	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Lang\lang.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Lang\lang.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2676
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Lang\lang.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0fd67cb6b43af7866a1da00bc5839319

SHA1
89a18f66355cb21d2fc32f8caca98c6b444e180c

SHA256
ddf9ebab8d3996438e275a34d593839ab19ff3b5a8247be55586b9f49fa19307

SHA512
5594b679d3c5727b67ba3ea9f126b7f5ec697a9662dc175399ad319fdb4a7d7da2c09fba7a70b777ed21ff36ed089f926662dcb28406e08be537a2e43605effa

Download Submit