cef9fbebf044457417badcacd0822ba13ed1c15f5271b70d5bb5c92491789c19

Analysis

max time kernel
16s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SoftWorks.py
Size

6KB
MD5

008a339465d8d133a94b70f966ec9fec
SHA1

97b1df2be745cff224f8230cf3a783bdf1e77f8e
SHA256

cef9fbebf044457417badcacd0822ba13ed1c15f5271b70d5bb5c92491789c19
SHA512

b62a068bc3fb251f6810fa53b6416dd23a0453bdd5d79d06f624a68f0938adf320722fe4e1ec2a7667daeb5ca18394f1174222a0e79bfc97f1cb6e537f6fae20
SSDEEP

48:xtmESOejrHFNlv1p5P/dn49YV9/KH4H1FOgjNgtpVtNBS/1M:LrHejrHFNlvBP/dV4mZWttNBc1M

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2760	2720	cmd.exe	31
PID 2720 wrote to memory of 2760	2720	cmd.exe	31
PID 2720 wrote to memory of 2760	2720	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SoftWorks.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SoftWorks.py
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...