f96348bfffc7623d80de75b78930f8c16056ca45443bb9267e524ec928ce251e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
04-08-2024 20:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

874KB
MD5

02de97367f72f94eacb5977d8d432f03
SHA1

b4b51d2e9acddb7243d33b4f75f0f40342e58218
SHA256

8f2144eb89529f698a3da9c391c5317df66fbbe0ddb01962c8ba1189442f0e29
SHA512

2eacc76b1a96909708dd69733dba98b653f15fa56f25058db89a81a08f164536f126a73883b6b66b52a3ee6e0a98b426a3f2512d14402caa817b8d6469906bbf
SSDEEP

12288:0k6zHX9/jhu2pGcvLp0J9eQ4vmZtLu+x2oyYblMvMpWTcqwayLSa+dYMQ6V7MZKj:0bz3ZjhbwCpk9svNybDolyua+OB0PC3u

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3020	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3020	AcroRd32.exe
3020	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2392	2188	cmd.exe	31
PID 2188 wrote to memory of 2392	2188	cmd.exe	31
PID 2188 wrote to memory of 2392	2188	cmd.exe	31
PID 2392 wrote to memory of 3020	2392	rundll32.exe	32
PID 2392 wrote to memory of 3020	2392	rundll32.exe	32
PID 2392 wrote to memory of 3020	2392	rundll32.exe	32
PID 2392 wrote to memory of 3020	2392	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
602647fb9f75e983c205d482e05a37f7

SHA1
b4718d3f88bda243f0fa843d30b613631488067e

SHA256
efc2b765c1aad475108ae6c6e6bbb16a6aefbca46a2babeee7c8ae395dd23935

SHA512
2fc482646aaa0b02b4830f4438bdbf145f302d40f9289f1f0e5cc5f578b206ee82e4bf5303af790991cfbacfda5abf3ec6ac4f920f7f5d0401fad17daa3cc924

Download Submit