f193169ba8a47a5d7ee7d90b363764e3ce0a00fd7a069994635dc599c4534fe0

Analysis

max time kernel
102s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/event.py
Size

4KB
MD5

b4e776dadc850158bba1141baf58e371
SHA1

e608dcc8f90be5b032b5e26ae350ddd006c15862
SHA256

007c0bddff67bf1ac85499bca113f251fe50eb02d0ddba4c3a01c97e63c56e5f
SHA512

47d924661a2bb15b95ab83547c80b916c1d71cc9e1102795f6098ad40a3956c7b779152ed36f29ca7968e71411961f11095872fd47197e119ec796bd24356994
SSDEEP

96:OdtCNAPENw7S0eL0/e3s6yS0eLJiNyS0eBbiTBp/yFQiPQ+:/+PEoS0e4b5S0edi4S0eViP8

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2792	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2792	AcroRd32.exe
2792	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2892	1724	cmd.exe	31
PID 1724 wrote to memory of 2892	1724	cmd.exe	31
PID 1724 wrote to memory of 2892	1724	cmd.exe	31
PID 2892 wrote to memory of 2792	2892	rundll32.exe	32
PID 2892 wrote to memory of 2792	2892	rundll32.exe	32
PID 2892 wrote to memory of 2792	2892	rundll32.exe	32
PID 2892 wrote to memory of 2792	2892	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\event.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\event.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\event.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eae7895dbba346c5326cc361b1bf0752

SHA1
5159201a0819081612b34a84d065c9033d813b6d

SHA256
f3726024934f22d4f51e0d237b2f4228902154c8ff899785b5221c6bb24b08ef

SHA512
4849b55c5dbf403990dea089c0546338bafe8e2d2307fd75c1801243f467ffd61db9d8d1d3fc9776694418c94efaf3cdd436751197da63608e31764ccbb629f5

Download Submit