38c0e56a48ed8384e384ac193ef96dbb9abcf152ff6ecff7a5b10e8f65949b77

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_exceptions.cpython-310.pyc
Size

10KB
MD5

01a2d5a968b5ea59c4367bbf09f6ef25
SHA1

b5422a4e76166493baecdc0567eb3512be333efc
SHA256

bb84c6adfbeecc7bd85ec8f05589a7eca54f8efd6d8f4ff75f11b4e2fa8bf9af
SHA512

df221fac3e7b011b588b4dd31fa90a620d72db6c457a93fc50a3c8135faf2cd51b9fdf9c384d87f45a83a8db6d86942ac25e9d78b65e5ed1eef5f92aa88b5071
SSDEEP

192:1dNhUOW0ku+NQpC/1fC6gJI0Sp6faKl8fCaFVssqBa+:rI1NeTSpV087jssqI+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2884	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2884	AcroRd32.exe
2884	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 1904	1932	cmd.exe	31
PID 1932 wrote to memory of 1904	1932	cmd.exe	31
PID 1932 wrote to memory of 1904	1932	cmd.exe	31
PID 1904 wrote to memory of 2884	1904	rundll32.exe	33
PID 1904 wrote to memory of 2884	1904	rundll32.exe	33
PID 1904 wrote to memory of 2884	1904	rundll32.exe	33
PID 1904 wrote to memory of 2884	1904	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_exceptions.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_exceptions.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_exceptions.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
60cccb58e93ff65dbac9c621e368fc3a

SHA1
8899ffec39db94ac9adcd711c6977f6f68256c8a

SHA256
59d0879ea9662b42dfc372d8e734a025080f7fcc274e4297903b08312d11143f

SHA512
f85dc1f0850b425e84e48b5bcf4331d5c92997ce9f1a449449ab95a62ac76d9ea619e7fb8bc1b149c551bca84e8780d4eb22753b5e766e1eb741232a5bac011a

Download Submit