38c0e56a48ed8384e384ac193ef96dbb9abcf152ff6ecff7a5b10e8f65949b77

Analysis

max time kernel
122s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

.pythonlibs/lib/python3.10/site-packages/aiohttp/__pycache__/abc.cpython-310.pyc
Size

8KB
MD5

5fc0aeb76f1902191302100293f09e4d
SHA1

67031dc9050b50535fdb062abf6b5a2cd2be90b3
SHA256

412dc87e88ace8a8a91bfe960640a9e3ab08d1dda8e34ed977ad9bbb953ee490
SHA512

4dc2f58d60170e3b28cf476dc7b23e984b1c1693b036cfda50fd5ae2eba9d6e653e865d203dc36f460f262a7fd6ed224344ef5a075b6704bb9e62c90f4324546
SSDEEP

192:JiQOOX5AKfYYd3yCtqAhAqZHTvyyTcHt5Cd2alrST9PC:PpfTiCt9AqZHTTStneST9q

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2756	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2756	AcroRd32.exe
2756	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2256	2872	cmd.exe	32
PID 2872 wrote to memory of 2256	2872	cmd.exe	32
PID 2872 wrote to memory of 2256	2872	cmd.exe	32
PID 2256 wrote to memory of 2756	2256	rundll32.exe	33
PID 2256 wrote to memory of 2756	2256	rundll32.exe	33
PID 2256 wrote to memory of 2756	2256	rundll32.exe	33
PID 2256 wrote to memory of 2756	2256	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\abc.cpython-310.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\abc.cpython-310.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\.pythonlibs\lib\python3.10\site-packages\aiohttp\__pycache__\abc.cpython-310.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7086fbf16b927b7194c489fb4cfad23d

SHA1
f304d51af9d4eb0170da6bbde5d6382797866dc4

SHA256
20c65c4e9eeb156fcadb032e461a7b823d7e90f1d64a7e7c8f411603eaaf8352

SHA512
cfb2fd72f930895cc6ad3668379c29ef477c652478adf71a2d980fb0ecf87609e0074e7aa4fe28594da43d891cf5dc54384fce7bd17b907eadc81434a4a61d05

Download Submit