1de458341eae15ac74b712b473492d669e03edf07114d080519e05d39f7b81a4

Resubmissions

04-07-2024 17:35

240704-v51qyazgrr 3

04-07-2024 17:33

240704-v4v43asepc 3

04-07-2024 17:29

240704-v2rzmazfpr 8

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 17:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Res0luti0n.py
Size

21KB
MD5

fc94afada011ee92d7df9ad6bf1cbcac
SHA1

b786cf28ad131fb3217a210a1985a9cffaeb49fc
SHA256

1de458341eae15ac74b712b473492d669e03edf07114d080519e05d39f7b81a4
SHA512

235fa52216746871c2eac55537086d950b16c05d214db39c04744952d8908fc8930d2ebb2f8969729d3d0a6b60ff2575a0e31729015e4263755a4f3db69921bc
SSDEEP

384:zDycqrGHMac80GeLinexF3R/7MUeVpQ1l/BOiskG+EWPBhKdUoZIN5zZXzL/kqL1:wj/Zrs29plbDa3K

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2636	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2636	1968	cmd.exe	29
PID 1968 wrote to memory of 2636	1968	cmd.exe	29
PID 1968 wrote to memory of 2636	1968	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Res0luti0n.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Res0luti0n.py
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads