f91388482f2290f34015c7d4accc7e29219692a33d1e99e76ead9bbd7b8fffe4

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Kematian-main/panel/ui/modules/first_time/first_time.py
Size

10KB
MD5

1fa54b0b884188394168c73f896e1711
SHA1

553777f80a321f7857dc5ea7e6c1b796ecebd94b
SHA256

a3e3e6a7bccd47caa3e4e8d2f1b2a6fb874415c06d61c8d0d697ed90abf6f6a9
SHA512

e49fb49c124aa0c4f932f16d2db64f77ff8a84a68154d91458e2b45276a2ad90bf8776e23326bd4c7d4378e3ad53d0919bb3edb2647bc3d70f2b16e1a7d4e0d5
SSDEEP

192:cN2iV8yZ8t0tHcXgoWvp9nbGBkNHRDXXRXhtCtDXHtI:+2ENZ8t0tHcXgoepFSBkNHRDXXRXhtCM

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1900	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1900	AcroRd32.exe
1900	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2784	2668	cmd.exe	31
PID 2668 wrote to memory of 2784	2668	cmd.exe	31
PID 2668 wrote to memory of 2784	2668	cmd.exe	31
PID 2784 wrote to memory of 1900	2784	rundll32.exe	32
PID 2784 wrote to memory of 1900	2784	rundll32.exe	32
PID 2784 wrote to memory of 1900	2784	rundll32.exe	32
PID 2784 wrote to memory of 1900	2784	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Kematian-main\panel\ui\modules\first_time\first_time.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Kematian-main\panel\ui\modules\first_time\first_time.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Kematian-main\panel\ui\modules\first_time\first_time.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e1615debd295109f87a7b275aa017e0c

SHA1
2282ad22e2b6485232e8622a0d454e68466f80d1

SHA256
b4f995ae6983b00cfb0ce4ba4dd90716ea8e3a09ee16355afb1d62195ee12ec2

SHA512
3dbc6464110ab95cb1afbb06cdb201de7e0bdbb23f6feb5ceb862ffa1a1952354717acba9a33b7aeae0641a5f9128120a661a08c47620f577ae9491bbff81c2d

Download Submit