38c0e56a48ed8384e384ac193ef96dbb9abcf152ff6ecff7a5b10e8f65949b77

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/helpers.cpython-310.pyc
Size

29KB
MD5

de3218f0f23a27630f7bea65851e24bb
SHA1

0a7a548176ed5d93cd51715cafd103ffa2100b87
SHA256

fb983069af08f830434b596924c54ab94032fb064b2e0dcd366b02e709dd2056
SHA512

5551e7fc2a4bbc1d02f03c7f8adce0beb013c5a12481f1199293063d990ccc68f83268afb76627e64d0e14cad446f38f958d43b117255f1cc89522cf021c0402
SSDEEP

768:WBcN5d7hG3C805rv8KARkpYUBvJ52WFX9s+fV0/9Lj2V:W8Pk0JkDRkag5jD1tU1q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2520	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2520	AcroRd32.exe
2520	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2500	2720	cmd.exe	31
PID 2720 wrote to memory of 2500	2720	cmd.exe	31
PID 2720 wrote to memory of 2500	2720	cmd.exe	31
PID 2500 wrote to memory of 2520	2500	rundll32.exe	32
PID 2500 wrote to memory of 2520	2500	rundll32.exe	32
PID 2500 wrote to memory of 2520	2500	rundll32.exe	32
PID 2500 wrote to memory of 2520	2500	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\helpers.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\helpers.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\helpers.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4c25a4a7e628b84c82d6d73b8aced94e

SHA1
3bc44b5596f4975830461075088f1679efc0dd21

SHA256
f25e93c7b41e3c9133d0a98c608b978de9c2f75c895d100bb32b5bede1309cd2

SHA512
1027f55e246aa973a7f869f2e67173d846b629386fe299914840bf5841a310072e6e53a2e24a4ef776557158abc48f4e42da8a64085adea95b65bbf6b2f15422

Download Submit