e11c355ff5369056c5340c6d8e95a333296b12c607a7bcbd2adbb6e12abed328

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Pirate-Cookie-Grabber-main/PirateStealer.py
Size

8KB
MD5

dfb7d12ba7d23b43988bf2691e574075
SHA1

3354b1c01f1330cab1ebb8f8c92407db8aa29b62
SHA256

cd90bb7c4ac2d506703b5fe86de275b12f31dababa9a411f866550d64b486e71
SHA512

315b9fff8a3ad4df28e9632ba19e80d8d21815c31c360876a80313fde4958da9c27a8471eca07c97c137fb983e9801b6175d72cf16af2134a8cf8e6ba2f5b8de
SSDEEP

192:Vfog0I13vomGoM97/jtiwidJ2uRWJ9C2fVCj:VpTWnCqCj

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
328	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
328	AcroRd32.exe
328	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 2576	2648	cmd.exe	31
PID 2648 wrote to memory of 2576	2648	cmd.exe	31
PID 2648 wrote to memory of 2576	2648	cmd.exe	31
PID 2576 wrote to memory of 328	2576	rundll32.exe	32
PID 2576 wrote to memory of 328	2576	rundll32.exe	32
PID 2576 wrote to memory of 328	2576	rundll32.exe	32
PID 2576 wrote to memory of 328	2576	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Pirate-Cookie-Grabber-main\PirateStealer.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Pirate-Cookie-Grabber-main\PirateStealer.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Pirate-Cookie-Grabber-main\PirateStealer.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7b59f3f0ce646db72ce7bf3580ff49cc

SHA1
e2b9bde6086c67cbe15ba76f9a5f6fa5e1238884

SHA256
8588728aafa804b08265995d3bbce57a2f0197b4d5216915fa4e5c5ad8b81ed7

SHA512
8c6064c52ec61b03a5d98a4c78209f366e51dfac3c2fb5b9fcb36cc7e1bffc1fdc294b78b1f55109eca4d61ce385655f34d8a593ff4a0ba318f31145bd4a1838

Download Submit