5bd5a7e8cb021c850cc4dfc7c4efe639f586b25e80d789babb32d6fcd52edc29

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

F-M-E_V2.pyc
Size

49KB
MD5

3fcdda41bd6499b991a3c0b165befa5a
SHA1

4bdfa81a09f9f16496a0c6b24361ce925824f6d5
SHA256

69550662c9637097f6be3e46366e5a10930eaaf9da9586af3f48dbe020b2d8a6
SHA512

d214285a2d9530ce759980a964a93a112c119b70f947727bfdd3a66fe2f60199bd009ee96e24bccbb4df1dbecfa0c7de9156a620c8c2883bee6fedeb983ce678
SSDEEP

1536:t9MWrHbR5Tp2kLfi2zncNLqrnh8nPlqDlhLx3USgeC:Vd5Tp2kLq2yqrePGUaC

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2660	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2660	AcroRd32.exe
2660	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 3068	2960	cmd.exe	29
PID 2960 wrote to memory of 3068	2960	cmd.exe	29
PID 2960 wrote to memory of 3068	2960	cmd.exe	29
PID 3068 wrote to memory of 2660	3068	rundll32.exe	30
PID 3068 wrote to memory of 2660	3068	rundll32.exe	30
PID 3068 wrote to memory of 2660	3068	rundll32.exe	30
PID 3068 wrote to memory of 2660	3068	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\F-M-E_V2.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\F-M-E_V2.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\F-M-E_V2.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b21f70d1d28f71d3569d4698e7e3f17b

SHA1
725e6e9d5f7dc995cbeed16148846978a88fd8c0

SHA256
33090a6e816975cfa3033bbb1f25ade9ac93d6dcdca25d0fd2793ab13d3bdcf3

SHA512
ecdd16d81027c2dda1db9a3ecef7bb18c042f99389f6417f42f2b107eab205500b762e76b9487893793ddfc8f3d607971d0ea29d622c001af2946451edb11166

Download Submit