a62c67bb2c90d79ffc64d3862c73ea77255581d224a8736c470dc72a6716c6e3

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/07/2024, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

MyExploiter.pyc
Size

13KB
MD5

b2b370d9ed7af6e9ce5c70282a340065
SHA1

1b401e38bd858298488c617cbc4b1a3add683426
SHA256

c7469231ce73e65751a62beb5b3fc8c64db9e90391fd3af9d70f01fe27b0f7e4
SHA512

5c3a1665a1bd475032d2cfba2122df85401f2b8706ed92729c1465c231e587bd6be7dd20ab56bc75ada95dc2753904802b0fa5ae7ad236bcf01e5aa2cb20002d
SSDEEP

384:shomx5IVX9ZVsf4Po0xKk9cbgH1UYHPFrnwC9vXeBDGKpfdp:ZK5IVX9ZVsf4Po0xKk91HPFrnwC9vXUh

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\pyc_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2612	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2612	AcroRd32.exe
2612	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2768	2860	cmd.exe	31
PID 2860 wrote to memory of 2768	2860	cmd.exe	31
PID 2860 wrote to memory of 2768	2860	cmd.exe	31
PID 2768 wrote to memory of 2612	2768	rundll32.exe	32
PID 2768 wrote to memory of 2612	2768	rundll32.exe	32
PID 2768 wrote to memory of 2612	2768	rundll32.exe	32
PID 2768 wrote to memory of 2612	2768	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MyExploiter.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\MyExploiter.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\MyExploiter.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
624bf068d828dc437bd7e1d345ddf39f

SHA1
21be1933b5035ca9402303a7c38d4c936567f4b6

SHA256
2160b7f16c39e7f6caf94eec002ffb681ea3320c31eb795d669d83aa64e5534e

SHA512
75c0d5bd7423ad5030ad959ed3873cf1ac9ac526005a43b6f69ea00da6a435b9d1dc0e0f37b0d8d2563207c3f53adac8daceb8e5dcab950007f22404fe8b6652

Download Submit