a7482e665aa974507d5c7605acc2da8d260465d765416472ebe798f73f99184e

Resubmissions

22/08/2024, 19:09

240822-xtvrnashnb 10

Analysis

max time kernel
104s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

v2/recaptcha_bypass.py
Size

3KB
MD5

51e652a04855251d52d5da921871422e
SHA1

ea1ef3a0b6d80d4d397d0dc6f59e3a97f7e66a49
SHA256

d99d0bd5f313e82444e34ff237184f6f3300dbcc2785a96de7702e68ac710896
SHA512

6934f8d33f957d24df66f1c8d2675f72613504114f234c6159dabfd8da9e956524809fc5c147e0146ae909ad333f24b848abbff9a84f65d81c76de48408aecf2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2932	2776	cmd.exe	31
PID 2776 wrote to memory of 2932	2776	cmd.exe	31
PID 2776 wrote to memory of 2932	2776	cmd.exe	31
PID 2932 wrote to memory of 2812	2932	rundll32.exe	32
PID 2932 wrote to memory of 2812	2932	rundll32.exe	32
PID 2932 wrote to memory of 2812	2932	rundll32.exe	32
PID 2932 wrote to memory of 2812	2932	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\v2\recaptcha_bypass.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\v2\recaptcha_bypass.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\v2\recaptcha_bypass.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
35365c78f4efe1c61db364860132fe83

SHA1
56f9f2e1d675acd1bd99d9e19393aaca273c4698

SHA256
c8c82f862b0fe9ecab0155b3a318c96bd9019e2ec6006e0458d6b3a98fac4861

SHA512
90d0e7f22722b5ae995ea1d86596843ee2a1c7a62996d0e7a70a1a0a54d2da75d8e10b8321c78866aeb9944279083e50fe5c8879c388de895ced599866cbf15a

Download Submit