1ba9cdf09d555d1e8a977932c7619f029d632966f09b0c2fc19a56849fe94b27

Resubmissions

09/07/2024, 16:43

240709-t8cb3svfqa10

08/07/2024, 20:01

240708-yr2mvswepl10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 20:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
source_prepared.pyc
Size 153KB
Sample240708-yr2mvswepl
SHA256 9590936403013c994ca2663e5e5b91cdf96874ee552548757c8e57a2db93d2a5
MD5 8532a966cf541ee1bc2a289f19b33255
SHA1 ce8ba18c94f98f476ecd820df22fbcb2a94e5adc
SHA512 3cba1a5f02fe145ea8de6b953cc9cfa4561456498a8ca40606cec152478f4510924aa9cec5b9cec6733f072b27470996b1a030532b931c3fb9163fd4d9c5ab56
SSDEEP 3072:yW546OIqDzxzrf+comPZTWZn5J72qgnIvdXzdsT+J:yO46OIqhpojntIisQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2928	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2928	AcroRd32.exe
2928	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 1052 wrote to memory of 2872	1052	cmd.exe	31
PID 2872 wrote to memory of 2928	2872	rundll32.exe	32
PID 2872 wrote to memory of 2928	2872	rundll32.exe	32
PID 2872 wrote to memory of 2928	2872	rundll32.exe	32
PID 2872 wrote to memory of 2928	2872	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 98534f85a29b5603068781dccf48a504266fcae40236f4e8215a0c8698cff2c8
MD5 d9825dc81c42b1ebb0f14ffc93aa9509
SHA1 ff938ee8a4ac5966f8cf2737b3c4da5ed86f507e
SHA512 60e9ff6973eb239a4fe15108e92a556c2976d8d6230e6a5dc52e774ac6911f3d23cc1d0eb9f79b403f0f9beff404657c42fe4dcf25976ede954aba8ed99e4702
MD5 SHA1 SHA512

Submit Download