44adad36384d5fe063fec38dd156b6d923968eb05e1ebb4fad7b55fea983eee4

Resubmissions

25/08/2024, 23:53

240825-3xfpsssemd 10

25/08/2024, 23:50

240825-3vnydstgpk 10

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
25/08/2024, 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

185KB
MD5

6577249f9dd7557eb6e0bb6704f8d32e
SHA1

8b402f962cef7352d4893978d29b7ef35ed38d6b
SHA256

96d1d60a5e6f0e71a9f589179748a9b49b175e347c870a8e20e10dd5502db6d1
SHA512

a815c8c96d4c5a918504558a1ace118afed3b83a36d90375ad638e3d5fcc6cf2092a25c471fd66878a177f02e1bdd0cdc62a946ab26c69b1ec5524abc9f0dbe3
SSDEEP

3072:ANW2La+fIA9MXUCeolPEtelZN+tVZactGgjHB1Ckn0:ANHW+fpweol8cN+7ZactGgjHrCh

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2648	AcroRd32.exe
2648	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2196	2268	cmd.exe	32
PID 2268 wrote to memory of 2196	2268	cmd.exe	32
PID 2268 wrote to memory of 2196	2268	cmd.exe	32
PID 2196 wrote to memory of 2648	2196	rundll32.exe	33
PID 2196 wrote to memory of 2648	2196	rundll32.exe	33
PID 2196 wrote to memory of 2648	2196	rundll32.exe	33
PID 2196 wrote to memory of 2648	2196	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ea79574d0123fa7fa47dde1dcceedfa2

SHA1
43b4d2542cb0b4a06375c4de7c2e2eb21b016c9a

SHA256
d7e25c6764cb8c333036d25840b5ff564ab22bd7d708cd17edeee517b39e0b9d

SHA512
5a7cc267f6756c6d92dc5bb48440e82758162c28266b40d30c580321c7dc052a079c0767c05313d175b29a79942a1a8390faecbe3b5fd8abd7957c076dd346b8

Download Submit