7231520b32ae609bd02ba7ca3b7b3617296925c25b499f984c3fe4b41fc3e241

Resubmissions

08/09/2024, 17:19

240908-vvs84sxgkr 10

08/09/2024, 11:26

240908-nj75kawapb 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 17:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

get_cookies.pyc
Size

9KB
MD5

b3e069a6d0520f658a3fd652a6e51ca0
SHA1

3e2590a43b110ec23dbbe4e55145c6f1cd27800e
SHA256

232fb80756e38b78775ec75d7ee46d15ac394ed7d197b577b2c98dd00709b007
SHA512

54a3cc21d321003808c2e1b9d52c06738ea0c80842d57ed754b05ff493157b22805a4d484bc46804d83ec052db535ceeb79708087355103cf75e3d2c9e0ce5bb
SSDEEP

192:kNal3eiNis9QfUF2x3NC79F211G67+EtAhN:kJiB2XtF7jKkAhN

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3012	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3012	AcroRd32.exe
3012	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2208	2004	cmd.exe	32
PID 2004 wrote to memory of 2208	2004	cmd.exe	32
PID 2004 wrote to memory of 2208	2004	cmd.exe	32
PID 2208 wrote to memory of 3012	2208	rundll32.exe	33
PID 2208 wrote to memory of 3012	2208	rundll32.exe	33
PID 2208 wrote to memory of 3012	2208	rundll32.exe	33
PID 2208 wrote to memory of 3012	2208	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\get_cookies.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f44c62b4b54b6a08e61e7a6b7a01799e

SHA1
b7ec5837cf8b522480ff05f54d183c764bd398c6

SHA256
ec57c47e51e1b304df1f2657a8e3d3716fe3f51411baf8e9dc7a671bc555bbc4

SHA512
d09d5856332b769cad72f574e3504de68c2b93262e29838c6d518aa6b568d815b3bf29456a45617cd8f443d5ae7d9ced8cfc87759b442800c18f1104184d5d5a

Download Submit