Analysis
-
max time kernel
18s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
29-07-2024 23:16
Behavioral task
behavioral1
Sample
V3NOM FINAL V.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
V3NOM FINAL V.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
misc.pyc
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
misc.pyc
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
source_prepared.pyc
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
source_prepared.pyc
Resource
win10v2004-20240709-en
General
-
Target
misc.pyc
-
Size
4KB
-
MD5
204ee497021e32209ddde0c015b4dc19
-
SHA1
6aa2c039e6b6fbfb3620d4fe42d115553702146b
-
SHA256
a8355eef70645468d11a410d1402e0cab31a194e87172b523b1ff3dea5dbb0c2
-
SHA512
961b15c0efe0478fdf9287e7b3b709233bcd9524be708f426b75dc91eb07ddfc2a2ce4f347d52a3e7402f5307ab755af093d660662fd3c4c465fd41e8d138d12
-
SSDEEP
96:ySMlhlv6KPDweHPF8+VB7sHIZGhIW0vmyyZ1k93hub:LolvJ0evq+VBXZGh4vmV1kFhub
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2748 AcroRd32.exe 2748 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 3004 wrote to memory of 2612 3004 cmd.exe rundll32.exe PID 3004 wrote to memory of 2612 3004 cmd.exe rundll32.exe PID 3004 wrote to memory of 2612 3004 cmd.exe rundll32.exe PID 2612 wrote to memory of 2748 2612 rundll32.exe AcroRd32.exe PID 2612 wrote to memory of 2748 2612 rundll32.exe AcroRd32.exe PID 2612 wrote to memory of 2748 2612 rundll32.exe AcroRd32.exe PID 2612 wrote to memory of 2748 2612 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\misc.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\misc.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5cfe2a15984c3d483be4d3a613c690ef9
SHA1cb86656ed62d75a4fc02f3ae05f9c707070e6587
SHA256ef1999506cd6c9027d25c2244a504821171cb77733fdd4fe5d3d29c3c6d3f3df
SHA512c7ee95e151153e4a40f923e165fa55dfcd767cf9b6f6fc563af8efca1104b2a91c40baf14fb329e896667acd299d847f69925c40dba9956a33e9e987cb28d39c