12fe45f52da38b0f313ad9bc6079ae3435d9accf4a8aabc7c0592fd5a62c2e02

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

198KB
MD5

6854be978a53c6d35514f1b4bfe7a6e1
SHA1

fb33aa70ef1fd7d8cbfb5948039a87ea5fe64adc
SHA256

3216b739bfb93ce54d9a75dd0b57162fd1d307d5db65aa8c9f0eaae86a62fb71
SHA512

0876c9982d706fde01b21dd701548b0164cfa29f7457ff8a2a35a8ceab4d2dbecb181c1dd73a89502100c5c98ea82cdb2158d5c1e21fa5883018c9f88ae12cfe
SSDEEP

6144:jeYPhfY7bj/mY8MYhYYYYY9YY5X/4+nIE:+L/hp/4+P

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2944	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2944	AcroRd32.exe
2944	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2704	1760	cmd.exe	29
PID 1760 wrote to memory of 2704	1760	cmd.exe	29
PID 1760 wrote to memory of 2704	1760	cmd.exe	29
PID 2704 wrote to memory of 2944	2704	rundll32.exe	30
PID 2704 wrote to memory of 2944	2704	rundll32.exe	30
PID 2704 wrote to memory of 2944	2704	rundll32.exe	30
PID 2704 wrote to memory of 2944	2704	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3880eab87189efc6b7381163bf4133fe

SHA1
51f6f9e5886c71a4decf2a5a24490d1e6ca3643d

SHA256
465600ab0e332f842db52ee61cdf06dc4c231e0f86b541e18bc1721a313cdd75

SHA512
aac0b9d3c510530548670560b41be117a046c9baad1135c68880ded64c16cf3918d4dd62cd8b04e4b5ddff5bfbb5ffa2289f14018d8c9fb3ec7d0e5d5e2f0c27

Download Submit