60469e59dd3f911ea4c04971f62ff891c97c5612c654ddb114dd47f7a1565d63

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
08/08/2024, 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Twitter-Account-Generator-main/helpers/captcha.py
Size

4KB
MD5

86768389643ad0f4a8101caecf72f65d
SHA1

a922aa68d656d38bf9df0fa91a4c91bd3600cae0
SHA256

13023e90d3d98d02f2b6a249966f21c4fbf71e01f5b10847f3ed52fe430fb48e
SHA512

3a8f40d7ee5cb11913d76eb68b389fb6b1f7b80801e7a731c94d09dccb18a0365e1f8cc4c21f8cd8513bc0a44a4ae80b238aca9464083fd3e5b377ac1cd90408
SSDEEP

96:uL6WNNsojP57cP7BzIys0Vauo7Pwxx6xiAm1:/aZjpcjBzIZFT76xMHm1

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2600	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2600	AcroRd32.exe
2600	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2756	2780	cmd.exe	31
PID 2780 wrote to memory of 2756	2780	cmd.exe	31
PID 2780 wrote to memory of 2756	2780	cmd.exe	31
PID 2756 wrote to memory of 2600	2756	rundll32.exe	32
PID 2756 wrote to memory of 2600	2756	rundll32.exe	32
PID 2756 wrote to memory of 2600	2756	rundll32.exe	32
PID 2756 wrote to memory of 2600	2756	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Twitter-Account-Generator-main\helpers\captcha.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Twitter-Account-Generator-main\helpers\captcha.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Twitter-Account-Generator-main\helpers\captcha.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ceb1e3a043fa9ba40d50e5d10ac567b7

SHA1
f14237d8379378f7b8282e4730c8ee4a32b23911

SHA256
5541be86b7979aa747317b588a26d71af0e608a1e9bc31d1c0161d77fbd711c5

SHA512
c9cd92f9749bce1263eda6e3e17583321734892ca0a14c192418e2fc4bba2ef08e5b5c595480c16ba2f5d58810fef2bd7b01023199b7b1d2471b5d093e2dffec

Download Submit