Overview
overview
7Static
static
3HW ON TOP.7z
windows7-x64
7HW ON TOP.7z
windows10-2004-x64
3HW ON TOP/...SE.txt
windows7-x64
1HW ON TOP/...SE.txt
windows10-2004-x64
1HW ON TOP/...V1.exe
windows7-x64
7HW ON TOP/...V1.exe
windows10-2004-x64
7ss.pyc
windows7-x64
3ss.pyc
windows10-2004-x64
3HW ON TOP/PORT.exe
windows7-x64
7HW ON TOP/PORT.exe
windows10-2004-x64
7port.pyc
windows7-x64
3port.pyc
windows10-2004-x64
3HW ON TOP/config.json
windows7-x64
3HW ON TOP/config.json
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 00:44
Behavioral task
behavioral1
Sample
HW ON TOP.7z
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
HW ON TOP.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
HW ON TOP/HOW TO USE.txt
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
HW ON TOP/HOW TO USE.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
HW ON TOP/HW FREE V1.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
HW ON TOP/HW FREE V1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ss.pyc
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ss.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
HW ON TOP/PORT.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
HW ON TOP/PORT.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
port.pyc
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
port.pyc
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
HW ON TOP/config.json
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
HW ON TOP/config.json
Resource
win10v2004-20240802-en
General
-
Target
ss.pyc
-
Size
13KB
-
MD5
ae7fa41ec3a7995d4db797fc827aee4d
-
SHA1
2d6f03e121c1d414fee6d49baf8c713ff3cf7335
-
SHA256
06339586a4212461ad96229441247ddddcb42a8f314a85d3b694614341f14033
-
SHA512
38189b84b9f0515aff1a9638ba3185497760c8d0a62670e939b7f8c0b0370856d9094742d579159c94b0d9c09cf8e57d8d3aa353babfc61cb1f4c70b3715a111
-
SSDEEP
192:64p70dVbrranuegwKaw4RSf4PMgBH/sHsSMsCqZWP:v0vran+Iw2SSMoUHZMsCXP
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe -
Modifies registry class 9 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.pyc rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\pyc_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\.pyc\ = "pyc_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3056 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3056 AcroRd32.exe 3056 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2296 2508 cmd.exe 31 PID 2508 wrote to memory of 2296 2508 cmd.exe 31 PID 2508 wrote to memory of 2296 2508 cmd.exe 31 PID 2296 wrote to memory of 3056 2296 rundll32.exe 32 PID 2296 wrote to memory of 3056 2296 rundll32.exe 32 PID 2296 wrote to memory of 3056 2296 rundll32.exe 32 PID 2296 wrote to memory of 3056 2296 rundll32.exe 32
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\ss.pyc1⤵
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ss.pyc2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ss.pyc"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5e8ba6fa4b35137953c253b91354b5a9b
SHA1b6f558c04e668ef5ffdeebb8864a0f17cbe6a02b
SHA25665822984d79332deb5c6c774133fc1a3145d7f21d7190a1be4f5ce9cc6c41648
SHA5129cd73b8249253553f757a7331d65cd9cb01ea85ae2bb987e38dd448a5e5469f4b12f7b7ad04b2e6c0c73c24c1bb585ae298825fda25bf0429e11a841999ba8f4