ce27061cd0f707eed21d820be9d086fe0b313e6d93f735d4600126e3fb73dcf7

Resubmissions

08/09/2024, 09:49

240908-ltpd4aygpj 6

07/09/2024, 21:53

07/09/2024, 21:50

07/09/2024, 21:47

07/09/2024, 21:46

07/09/2024, 21:44

07/09/2024, 21:41

Analysis

max time kernel
836s
max time network
837s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 21:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DDoS-Ripper Pro/pytransform/__pycache__/__init__.cpython-38.pyc
Size

10KB
MD5

ef205108a644367eb72a426aa0937304
SHA1

541b6906da13a79ce87c7696cd7e07db68238a45
SHA256

10c5cb910c18b4bbfd57ea861f327f28c34cc607bdbb6022e904f0e6fd1ae414
SHA512

a61c240a84e93481c67ee875f530db6bfdaeeec61eb928d0e70dd70d23ab2470786131eed2fe4dbb80d20408947439bbd0e137c094c44563569ace575bf5ab2e
SSDEEP

192:WR52l5YS/RUHvy3qWJcm+R/G+qOEv4yqxbPSUUJU1T6YaP+wOR:Wrs34nm+k+qXv4yqlPSbJKayR

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2984	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2984	AcroRd32.exe
2984	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2300	2960	cmd.exe	31
PID 2960 wrote to memory of 2300	2960	cmd.exe	31
PID 2960 wrote to memory of 2300	2960	cmd.exe	31
PID 2300 wrote to memory of 2984	2300	rundll32.exe	32
PID 2300 wrote to memory of 2984	2300	rundll32.exe	32
PID 2300 wrote to memory of 2984	2300	rundll32.exe	32
PID 2300 wrote to memory of 2984	2300	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\DDoS-Ripper Pro\pytransform\__pycache__\__init__.cpython-38.pyc"
1⤵
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\DDoS-Ripper Pro\pytransform\__pycache__\__init__.cpython-38.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DDoS-Ripper Pro\pytransform\__pycache__\__init__.cpython-38.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
5ac3d21683d5177148374eb658da1c0e

SHA1
8c75ed82c4ff6c478805b74dc767a2f2d67064d8

SHA256
6b73c2af79d536f2ca972fd95edf8f8bf615a8580be108b299fa45f76bd1c265

SHA512
7ba09145fd6b1398721dadb4d229baa87aa2f93377ad8e801856ea43015a24de9ee57632fef155f541bd1074f7689c3241a13a7d96ad3b06d3e6389cb2f779fd

Download Submit