f193169ba8a47a5d7ee7d90b363764e3ce0a00fd7a069994635dc599c4534fe0

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/async_tools.py
Size

12KB
MD5

6f08fe3cef275c435a9af95891a168db
SHA1

ef5e7db3b423f804f0aa38101fd911e9fbbc9965
SHA256

94e3fb7519efd5d202248fc9bed274cf79d83d7550e48ef644463afd11422a4c
SHA512

196a8a7b4865a7dd0b8a609fa08ca01da834cb3176bab53a1ecf324433574b82d4c4739638fb68d799b40746c6e8d21e5693a7131c7f35f60a1b0d582818d345
SSDEEP

192:DLIbR8GuAnGK0WGD1XZ313LcWod01a4FXZ5PSTpvHXrWIgpI2FlhafXrhQlB6ARk:f4C7K0BD1t1N1DJ2i3dO9

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\.py	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2572	AcroRd32.exe
2572	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2720 wrote to memory of 2892	2720	cmd.exe	31
PID 2892 wrote to memory of 2572	2892	rundll32.exe	32
PID 2892 wrote to memory of 2572	2892	rundll32.exe	32
PID 2892 wrote to memory of 2572	2892	rundll32.exe	32
PID 2892 wrote to memory of 2572	2892	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\async_tools.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\async_tools.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\async_tools.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e400a6db40dd0d4f1f3c121902874b29

SHA1
92ef15b97be9449ddefdb0f5815e31a668a832f6

SHA256
e9afed7e4530c57be00c565919bf1dc7e4ac5ace11e2f9bdd9e22a2bf2b57d0e

SHA512
963cd8e2c17501415095fb8a89adb6097c2ae585ead7276a07739ba46149e80c48f286d8eed19bd07c7f2d784beef282140b9ba62abe9e31eed3c61b4d1b6c3a

Download Submit