73c8170cc05b69721269b77d161be6e2bf2a544a6422fcb9a4bf615376e4bb83

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/07/2024, 23:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

auto-py-to-exe-2.44.1/auto_py_to_exe/dialogs.py
Size

2KB
MD5

f5726afac291f09e10f6bca647aaca01
SHA1

6e86cf8e8dd72191f4652e804ee5bdf0b8ca2626
SHA256

09cb5fac2d88de23c07d7c11a5a78f2350789dac3c75fb9c241c8bdf07d7f426
SHA512

9abfc9299abd18a20f92db2b27669d360806289171d8e5cd75d59430ec0e315fafc4928aff85e4dfcea57abbe9456c2ca2f59bf5b3cc5423d43f36f25149209a

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2780	AcroRd32.exe
2780	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1632	1712	cmd.exe	32
PID 1712 wrote to memory of 1632	1712	cmd.exe	32
PID 1712 wrote to memory of 1632	1712	cmd.exe	32
PID 1632 wrote to memory of 2780	1632	rundll32.exe	33
PID 1632 wrote to memory of 2780	1632	rundll32.exe	33
PID 1632 wrote to memory of 2780	1632	rundll32.exe	33
PID 1632 wrote to memory of 2780	1632	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1\auto_py_to_exe\dialogs.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1\auto_py_to_exe\dialogs.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\auto-py-to-exe-2.44.1\auto_py_to_exe\dialogs.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
52f288930a659a456427704994f46eee

SHA1
390ecbd1a211f7a37a8c0fc68c5a7bd93e15e231

SHA256
55ccee423186ba005fe130d51271c9a8018377c7291f55a7a77a5617318538d2

SHA512
14718219caa314329831d585251b75efdb3b44f16a987fec186f48e76205603c1dc0d8f99aaccd17760bc783ae0f2f664bd037d61ee69429446bd773531ed778

Download Submit