990c72378a5ad30adc76cf8142997bcae5b7c698ba1cb80ac73f9a54bce593db

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
14/07/2024, 22:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

res/mods/xfw_packages/xfw_actionscript/python/xfwview.pyc
Size

7KB
MD5

866a6d2483eacf63aa19e9eb6188d9ee
SHA1

55734378005a61b6b6618540b07972f9d59a25b8
SHA256

7fc1ecf2e2d960f7a53e7e0a77678b10b5b3f4b30c90e6a470c793c77f2ae0bc
SHA512

9e7ed815cfaf0e7233c66c01c592ceb8216d960e99b2b4b66ca77b803cadbf6dab487e38ef727d069c9c412e300c3c7b7dfd5cae4f9d77ab0151c568a260ded9
SSDEEP

96:wzoyrHIjRSG4m+qnKJXItdRUVf9+T6SQBveeRs1FMfE08a+dr+YaLg8j:roHismLKXaCf9LS2rRoFU8aQ/aLg8j

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2284	2492	cmd.exe	31
PID 2492 wrote to memory of 2284	2492	cmd.exe	31
PID 2492 wrote to memory of 2284	2492	cmd.exe	31
PID 2284 wrote to memory of 2712	2284	rundll32.exe	32
PID 2284 wrote to memory of 2712	2284	rundll32.exe	32
PID 2284 wrote to memory of 2712	2284	rundll32.exe	32
PID 2284 wrote to memory of 2712	2284	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\res\mods\xfw_packages\xfw_actionscript\python\xfwview.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\res\mods\xfw_packages\xfw_actionscript\python\xfwview.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\res\mods\xfw_packages\xfw_actionscript\python\xfwview.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b69df357fe855c13ae19668ba7fda085

SHA1
deab2a8fe1a567b3a3dec173e2f427f149b74c01

SHA256
d3377cd49bc88695c95b424fa3ad6c261b87c0754df5ef5763662fec04102105

SHA512
8605a8dccb187fbc838c21f6ea1be1374bd362441290fd8b755050470f4d32ececc506fbc398fa508b4225e49087cc00249cdc29b285c0c22eabddb27fff3d9c

Download Submit