9b73f8eb1505799749b1b15c7a9ed63448f6b7658a2ef912dc4ce2b57b38ad7d

Analysis

max time kernel
0s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 01:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

photo_quality_update.py
Size

938B
MD5

c28014e8d58da631aefd9242fa19d8d5
SHA1

5d77c08e0f0865ab0af22f50e1eac1e32954dc66
SHA256

2f28a1971572899eb5de4859ebf4284c17b8cf1e2ee0c06382ea65e0f3df1234
SHA512

bdfb1add63ed349ff24576e626f714751621fbf47103c06b8029b30bf510a316646594208c8d03e31c80bf0287afb52b754be0a7ad4865a1cb2c8c8085e80d50

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2456	2064	cmd.exe	30
PID 2064 wrote to memory of 2456	2064	cmd.exe	30
PID 2064 wrote to memory of 2456	2064	cmd.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photo_quality_update.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\photo_quality_update.py
  2⤵
  PID:2456
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\photo_quality_update.py"
    3⤵
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c036ca02855c0d3ee3b156b66d888fe6

SHA1
3b4c53e9fd12f10d83eff9e5cc0a0e4a9cfcadc7

SHA256
8a8a21111a030da11584dd75253755738e985159e124709281a7977ea331228a

SHA512
6349efb5bc9df907067ee79c43e8c1609d7bcadbe5dd19007cae3277f560ebc266fd6920e2bfb801f67c4502ed4bb652ed70725e8ed7994e14496542101db04c

Download Submit