7b476bbfc4d37fa50c1c5bec98b2e8aede8087b8873eb7de27b78ad4446dddbe

Resubmissions

14/08/2024, 05:47

240814-ggy1jsxfkf 10

14/08/2024, 05:40

240814-gc194ssdjn 6

Analysis

max time kernel
1564s
max time network
1580s
platform
windows7_x64
resource
win7-20240704-ja
resource tags

arch:x64arch:x86image:win7-20240704-jalocale:ja-jpos:windows7-x64systemwindows
submitted
14/08/2024, 05:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

CyberDEV Client/lib/selenium/webdriver/remote/utils.pyc
Size

727B
MD5

c5b0c9d4946cbc737967509e6c83db1b
SHA1

6814fa7a5b243143ccf3624bd08f31fff836cde8
SHA256

796ea27fba24f8c0b79e88fb831b4a44c6e1fc18b9785d23e357bbab47f94b09
SHA512

15a46870cc614ba1b593cb06679faaf6f21f5b4c32c15012197ea9041f9ce85d793e36e0183d4fe90a688c8cc619595974587350dc037db11dcf93ea3c04dea3

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2272	2052	cmd.exe	31
PID 2052 wrote to memory of 2272	2052	cmd.exe	31
PID 2052 wrote to memory of 2272	2052	cmd.exe	31
PID 2272 wrote to memory of 2740	2272	rundll32.exe	32
PID 2272 wrote to memory of 2740	2272	rundll32.exe	32
PID 2272 wrote to memory of 2740	2272	rundll32.exe	32
PID 2272 wrote to memory of 2740	2272	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\CyberDEV Client\lib\selenium\webdriver\remote\utils.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\CyberDEV Client\lib\selenium\webdriver\remote\utils.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2272
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\CyberDEV Client\lib\selenium\webdriver\remote\utils.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b20104ddd43710f0065a19f97965b710

SHA1
823f049b63c86c27dc2cc5a22f07fd486712565b

SHA256
4879fc874ec60eaf8bfd8bf8d3c8f9f9b59f551bc4433ed1d61ae79e23775c90

SHA512
cf99c19c31c01589e7f5fbdb611d78d981b124f91388f82f8dcdfda81a39467c4caf5998f6c6578d9d9cfa5a0260c1f844065de7e1277b4b7baa3ac4f0bc919f

Download Submit