Analysis
-
max time kernel
122s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 23:02
Behavioral task
behavioral1
Sample
NNLoader.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
NNLoader.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
Stub.pyc
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
Stub.pyc
Resource
win10v2004-20240802-en
General
-
Target
Stub.pyc
-
Size
799KB
-
MD5
1883070249e753167dc78153e2326a4c
-
SHA1
73c3d759425f21638e9eeaea0972604fe180f77b
-
SHA256
57ed0a05eaca9932d88e48cad88eba55c103cad705f61fa9052b1d9573328d19
-
SHA512
f08cd69fd8cc37bdeb3e579c9c6df7dd45fdafa574a7fc74411ef11cbaad06f588dc06b5045da2bfc94244a765fc05cb482a7ab42f5248200ae9ae7690c80cdc
-
SSDEEP
24576:4DWVygd6NVH/xPY83LYVqnDmi43hOdXgKt:4JgmUqDFX
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2588 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2588 AcroRd32.exe 2588 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2848 2816 cmd.exe 31 PID 2816 wrote to memory of 2848 2816 cmd.exe 31 PID 2816 wrote to memory of 2848 2816 cmd.exe 31 PID 2848 wrote to memory of 2588 2848 rundll32.exe 32 PID 2848 wrote to memory of 2588 2848 rundll32.exe 32 PID 2848 wrote to memory of 2588 2848 rundll32.exe 32 PID 2848 wrote to memory of 2588 2848 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2588
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5611dc2cc167018a7508a656aee86bb77
SHA19678db6d81def71566307908c28cfd3ce4bcedf2
SHA256515c697a4025fcc757f7d69c160465164769578d1b2f88dce29500a04aca3b69
SHA512b132583ebdcf7c2fdb458a07ffa647d99296da60414058a59f44cc347a1f8f8136cd6952f0cfbb4488f22de15d25472432c54f477ae6cf38c740c640bfe98a30