87ec53dd9e90cc858b453e49fddecf56da7311e0e888cee70e3c6c67cdf8838b

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
06/07/2024, 22:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HaterCollecter.pyc
Size

57KB
MD5

3e6b658da688b5e4538d96d1f3bba4a3
SHA1

c005025e0f67d5385ba594ef0639af12b72c61b8
SHA256

896e62a81fa894962f65ee18adde9da069936f133bc7f2e0ef7dc35ea5b473ca
SHA512

769ca6f5c7664f6354cd988bfdd3f7f389a8c095a82990403e871efa61552088d4577f1d8ebf4ad0edbcbea9741a8449c9a47cd5f1b7f5dce61d5b8eb89ee4bc
SSDEEP

768:v16L99lxW4Jv09D/rBNVNic7tFMGoVAugA7Lk/7mflDRBfMS6LkX:g34/rlscsAugAXkjIltBfELkX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2784	2292	cmd.exe	32
PID 2292 wrote to memory of 2784	2292	cmd.exe	32
PID 2292 wrote to memory of 2784	2292	cmd.exe	32
PID 2784 wrote to memory of 3064	2784	rundll32.exe	33
PID 2784 wrote to memory of 3064	2784	rundll32.exe	33
PID 2784 wrote to memory of 3064	2784	rundll32.exe	33
PID 2784 wrote to memory of 3064	2784	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\HaterCollecter.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\HaterCollecter.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HaterCollecter.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d00794ab1ae59203117c0095cba4de8

SHA1
011e186c3565817bb0e9e84b2d244f10b0dd4ebd

SHA256
f26cccea53dfed249604529ade23dcc0f5e24270ac72add3ab23c28db6ff95eb

SHA512
760f18194e9a10fa2ede728149025431209e836e9c17f3e6a0c636a60b78586b30dec8aaa1f4f73541b2592babeb428616a425f9aef69853928c76180e2cab11

Download Submit