38c0e56a48ed8384e384ac193ef96dbb9abcf152ff6ecff7a5b10e8f65949b77

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/connector.cpython-310.pyc
Size

35KB
MD5

c2c16e34bfabd3d4ce19cc1a0bbb37fe
SHA1

447a1d6e9a1922262b87e5c244689c90a613605d
SHA256

a11f33af75fcee2319f8584d1ace2c6cee9a66cb729c9ce6a475c942ed0db27c
SHA512

2d6e98a7cfd4671071acca0cbee4a3864957fb8632f6905e8345914e0dd0f6fcc54aa6b5a0c5dcb47721996e496abe5ddc69c9b78e0de07a5e18b4d1bdd0697b
SSDEEP

768:Rhx4g40KkR3jdBnsTKHdT0eyU4BDvX92SaeG7AZbJvWv2egIMhlndgV2Pr9W:Rh2g40KkrBBdTvyLB/0jj

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1888	2640	cmd.exe	32
PID 2640 wrote to memory of 1888	2640	cmd.exe	32
PID 2640 wrote to memory of 1888	2640	cmd.exe	32
PID 1888 wrote to memory of 2756	1888	rundll32.exe	33
PID 1888 wrote to memory of 2756	1888	rundll32.exe	33
PID 1888 wrote to memory of 2756	1888	rundll32.exe	33
PID 1888 wrote to memory of 2756	1888	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\connector.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\connector.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\connector.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
effee743153b04c4595a37c4ede56916

SHA1
4092063f05be70d3ce595268eca4a714afc724ea

SHA256
675e0e1f72963a1c3ab2f8e531d298742fd029f3fbae8f4260ff23b5b644ab24

SHA512
34f9a883512416c202dfb3d12e6558365bdbd4af32fd494dbf6b53cca33b503bcdd3f377c2f473445901d67c7a17f0c7d8009c56a6a570c16d21b37219ef8121

Download Submit