491627c252208e9a03273af3b6fb8886ac44a443d8a54e1674b134c744909571

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19-07-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

bb97fddf5e1f52be7caf500020130df5
SHA1

0a8cd791dd27eaedc9e68488122c8f8c16e46e02
SHA256

f0869f8e46ae7859b89e3ec618e93e1143bddfb875859f28735f356ba7cf177c
SHA512

97ab06fe1332f4231c49782177daa833032f35a4bde44deceaa85954a276bf3e34899bd145070c14355422a9122c0de164339caa97946d9b975caaf459933d7f
SSDEEP

192:wCIhnHD8WVx519WdXw+Of3M4fqpPMJhwLVsMdw06nw:cnLVbWu3c4fqNA2LWP06w

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.pyc	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2824	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2824	AcroRd32.exe
2824	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 1712	3024	cmd.exe	31
PID 3024 wrote to memory of 1712	3024	cmd.exe	31
PID 3024 wrote to memory of 1712	3024	cmd.exe	31
PID 1712 wrote to memory of 2824	1712	rundll32.exe	33
PID 1712 wrote to memory of 2824	1712	rundll32.exe	33
PID 1712 wrote to memory of 2824	1712	rundll32.exe	33
PID 1712 wrote to memory of 2824	1712	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e9172d259e1b98c0d5c8d33a46414bce

SHA1
4f9ae2b2725fd50ea7fa8e1c1226abea54f3e4bb

SHA256
fc5e579f746715aad9d1eadbf9f7cb9eda3467f6f7d30801ec6ba7c384aad612

SHA512
a02f0d5f6f1c7b9311819e677e1264882c90b9befa1e9ec72c4d9300a33b21fa415b56c204bed8f0106ca50ee7e303f7fad897a77ab9011afb2bf7a290d564c7

Download Submit