3b5869397c4daaf4badca0590254e90e09d3e25373524d2952ae815432b35338

Resubmissions

22-08-2024 01:53

240822-ca4v1asepb 10

22-08-2024 01:52

240822-cafs6sselc 10

22-08-2024 01:48

240822-b78d1ssdke 10

Analysis

max time kernel
1563s
max time network
1565s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 01:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

loader-o.pyc
Size

1KB
MD5

8358a3f101bf92a60a415708dac86567
SHA1

65c56453a4244b1df554ed62893a9b1a9440c6b8
SHA256

640cb2aab4823221445741e72b36b792a21780cd39cec6de960d0175e651b7ad
SHA512

dc1afe637a7942689b3400326e7af731a0c32d608ab76ec47f480c949a143fd22e32a9a231e28d4572bad4bf17b31fee353fb4d6866541ed23244ab54e3a397f

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2724	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2724	AcroRd32.exe
2724	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2668	2644	cmd.exe	31
PID 2644 wrote to memory of 2668	2644	cmd.exe	31
PID 2644 wrote to memory of 2668	2644	cmd.exe	31
PID 2668 wrote to memory of 2724	2668	rundll32.exe	32
PID 2668 wrote to memory of 2724	2668	rundll32.exe	32
PID 2668 wrote to memory of 2724	2668	rundll32.exe	32
PID 2668 wrote to memory of 2724	2668	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\loader-o.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\loader-o.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\loader-o.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3104573eab8da53087f754f4c70eb473

SHA1
9dcee7f6d1677ef225128110236331f2b6a7f607

SHA256
718c8a3e12f37142d2d3c7323baf79b7c94d5263dabc41a5e93051c387be5ecd

SHA512
9e57f9ddcb885001f0666af5062ccd224a2c3b9245e60b8285cc8f96c91e463ec0437ed8c1c8dc9bb5dc7575e32646bea552501dfe6dc8206734dbbb3a7113f8

Download Submit