38c0e56a48ed8384e384ac193ef96dbb9abcf152ff6ecff7a5b10e8f65949b77

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/client_proto.cpython-310.pyc
Size

6KB
MD5

9ec8d9d229310dc2bec3363ee8c0eb78
SHA1

6992c76afbcaad69d064c3f34e239303ecdc93a1
SHA256

728ceb6c57f0cf1f1c52fca0089842e573fe379ceb26703796120435fb771cfe
SHA512

abcee77a210bad8ee4bc11aa19f1e3fe09e466462438a875a474b3171ea7b7a3e5128640a050e3eecad60fd0671917113033be1ccd3392007b3b8288c57041aa
SSDEEP

96:PA5KcwZyM2zMLmeAsmI1QkeQZLDY8Cp6C27qXduckTtFqw/xOVOjCr++ZbgABLGD:Pi1C7hD1kmc8pC2OtuJzJOVT3Zbg2CD

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2856	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2856	AcroRd32.exe
2856	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 2332	2424	cmd.exe	31
PID 2424 wrote to memory of 2332	2424	cmd.exe	31
PID 2424 wrote to memory of 2332	2424	cmd.exe	31
PID 2332 wrote to memory of 2856	2332	rundll32.exe	33
PID 2332 wrote to memory of 2856	2332	rundll32.exe	33
PID 2332 wrote to memory of 2856	2332	rundll32.exe	33
PID 2332 wrote to memory of 2856	2332	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_proto.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_proto.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\client_proto.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c5e10edfbbd506fbe5cac44f4c46f0ac

SHA1
9587ddc7e3fc4390e56e6f4f37360c8ae087da8f

SHA256
f899b1e4ba0a23545f4d79d5683de833a1876311ded7684dbbcab238e727cc2b

SHA512
fc47fab3e81835d0ec61dadfaa61ba4ffd5b1bd2ba2004cbb9c9d17595966b15f6460b968d3819f17b8b5a0289f5c8f24966ee947c12635eea2db8cecc7c0595

Download Submit