Overview
overview
3Static
static
11_FastToke...Gen.py
windows7-x64
31_FastToke...Gen.py
windows10-2004-x64
31_FastToke...rst.py
windows7-x64
31_FastToke...rst.py
windows10-2004-x64
31_FastToke...12.pyc
windows7-x64
31_FastToke...12.pyc
windows10-2004-x64
31_FastToke...ins.py
windows7-x64
31_FastToke...ins.py
windows10-2004-x64
3Analysis
-
max time kernel
117s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 20:12
Static task
static1
Behavioral task
behavioral1
Sample
1_FastTokenGen/FastTokenGen.py
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
1_FastTokenGen/FastTokenGen.py
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
1_FastTokenGen/run_this_first.py
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral4
Sample
1_FastTokenGen/run_this_first.py
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
1_FastTokenGen/util/__pycache__/pluggins.cpython-312.pyc
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral6
Sample
1_FastTokenGen/util/__pycache__/pluggins.cpython-312.pyc
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1_FastTokenGen/util/pluggins.py
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
1_FastTokenGen/util/pluggins.py
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
1_FastTokenGen/FastTokenGen.py
-
Size
5KB
-
MD5
5d57b315f8b6ab5cb4a874dd566d66f0
-
SHA1
1df738dace80a154337a56d3e8ec78e98fb83499
-
SHA256
39315ec8424765e466613a293ab3b781f52485e64db13db12b8bb573c0c677a1
-
SHA512
f0cc84fc73c02675491159bbf66fcd58d00f5e6a2722f2d6a1ff550180365dc2156850e13db004b9c84109f1e6bd26d6ec6cbbe751d00558e90d8855096a2210
-
SSDEEP
48:QgS+2UepIst10vy5mRe3CvJZvgLC9Voqprtx1O9+64JFmoX2godcoglDx4Weh/U9:xS+epIixuyCDv9TJFvX2x/9U9
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000_Classes\Local Settings rundll32.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe 1280 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2528 wrote to memory of 1280 2528 cmd.exe 31 PID 2528 wrote to memory of 1280 2528 cmd.exe 31 PID 2528 wrote to memory of 1280 2528 cmd.exe 31
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\1_FastTokenGen\FastTokenGen.py1⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1_FastTokenGen\FastTokenGen.py2⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:1280
-