f193169ba8a47a5d7ee7d90b363764e3ce0a00fd7a069994635dc599c4534fe0

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 23:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

robotcodedev-robotcode-280f0d4/packages/core/src/robotcode/core/language.py
Size

1KB
MD5

f11851420758683bd99b4e2166a6d3b3
SHA1

11076f411e36dd5ba8b36577454c6d95bbdca95d
SHA256

d5beaf866c22624117b50dbfe398aa5dd006e4a0f5b1d7a71b2019ccc2fb80d6
SHA512

d7194ed5b961d9538a2e47d3b6dc18c14e9d9baaba8b5d02debae637662156491d90a5553db08e3986e409fba3f59ba30ebc80fdf60f33300500b281ff40d5ab

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\py_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2880	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2880	AcroRd32.exe
2880	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 1740 wrote to memory of 2816	1740	cmd.exe	32
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33
PID 2816 wrote to memory of 2880	2816	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\language.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\language.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\robotcodedev-robotcode-280f0d4\packages\core\src\robotcode\core\language.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f8ebad5090ead19be1867e044370f87f

SHA1
62379603cfe596366995ac21154954aa27bff670

SHA256
50c8565d006aeb7187188a67e4410d864e0396138762488cc8a262ad8d4ab107

SHA512
2a0963b26ea3ead781f02cfa3bc557e4412f9a3a85843f6b0628150fe5486009981d2067ac649831d62f04787eff9d0ff291761316b9c92d8e09381e3230a8e1

Download Submit