0b4c002fa5150675098689eb22b3c45a20045b07b5abfbfa462e468aebac330a

Analysis

max time kernel
102s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

blenderkit/autothumb_model_bg.py
Size

8KB
MD5

39c458531a20863c303235f2f57d2fec
SHA1

c9f7ee8261a5e179749688f8a547ed3dedaed15b
SHA256

03be4d0b7782de9604710452f00aca954abcb645282c5c79d1f0c66962d8187f
SHA512

c6f8d4f6fe8ba16f987dcdac2bd087978e8f8f363e482cefd0ef987f0cba7b27e638d3dd6a5505344f51cb60eb5ed90fb5abf7946103c1070e25d203a88612b3
SSDEEP

96:kYefjpe6TfxyJHyWwp9oFSQfnz7r+u6xqHuCJZh9gwV5Z+BEzSorMdZ9J:tefnTJOHtwYFSUnrBJ5g9EzSDdZ3

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000_CLASSES\.py	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2924	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	AcroRd32.exe
2924	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 2644	632	cmd.exe	31
PID 632 wrote to memory of 2644	632	cmd.exe	31
PID 632 wrote to memory of 2644	632	cmd.exe	31
PID 2644 wrote to memory of 2924	2644	rundll32.exe	32
PID 2644 wrote to memory of 2924	2644	rundll32.exe	32
PID 2644 wrote to memory of 2924	2644	rundll32.exe	32
PID 2644 wrote to memory of 2924	2644	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\blenderkit\autothumb_model_bg.py
1⤵
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\blenderkit\autothumb_model_bg.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\blenderkit\autothumb_model_bg.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
532fc9f4d29572ae5fa783bfd36b0cff

SHA1
2fc0b135d343f8917755437e839f587d40ba9229

SHA256
13ba948778f24484bd634b391687b9e81cd9ee17e9a09e707d79b11530b44b27

SHA512
a413cb6654f5e665de8896588f75d223b05e096095524cddd5435e775406384b31d88845a3d94204bd4e2432fe0cba8accd55346e5d1bbefd93bde33b3fa699f

Download Submit