b365aca4f494c6339edbcf437d32a16f40f42e3ef6e8fbbecce48544e0d75610

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rec-Room-API-Tool-Box-main/FullTools/AnimatedBio.py
Size

598B
MD5

0dccb95095de89d0327cf858fba09213
SHA1

6511d00b0ad8c26536b4e9607738f0ee8d09b155
SHA256

e73685c7f2c0d5c9dc253eb17f0203fd45c40340c6c6799a6560c187fbb052e0
SHA512

b0b5684d74a3dbced50f5773bb14743080225e8bba7df8e9b96ab8d837c7cf93aae5ce864c4e9b2d8714d4911f37593e5757cdccec30e6ae2473de070172345e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\py_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2832	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 1928	1956	cmd.exe	31
PID 1956 wrote to memory of 1928	1956	cmd.exe	31
PID 1956 wrote to memory of 1928	1956	cmd.exe	31
PID 1928 wrote to memory of 2832	1928	rundll32.exe	32
PID 1928 wrote to memory of 2832	1928	rundll32.exe	32
PID 1928 wrote to memory of 2832	1928	rundll32.exe	32
PID 1928 wrote to memory of 2832	1928	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rec-Room-API-Tool-Box-main\FullTools\AnimatedBio.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rec-Room-API-Tool-Box-main\FullTools\AnimatedBio.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rec-Room-API-Tool-Box-main\FullTools\AnimatedBio.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1dcc920b58530ea21f9a0f3bff05d000

SHA1
71438f36c2f282ab0a754d08d087add6686bc834

SHA256
986ed2f5875aec0b22cd5b372d11d47d225df4ad45b3f5859f789a5b44839f6b

SHA512
55dfdcd038e73e86781b82a75297799a645b4d749d41ad4892be083677ff01993f8669295d3e4f37ab72ed9e390b4c92a7a0425912313fa4b693852d578b570d

Download Submit