9e9c304a4da7328fee6971f829d0c8a3031afae74427e55d679437f80cb1e6e8

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UpdatedIncognito-main/UpdatedIncognito-main/cert/__pycache__/certgg.cpython-312.pyc
Size

9KB
MD5

272ab8d6aec21d476ed8db995c7c8dab
SHA1

f8a043f7586ce1b58d398355c9171d76409f4ce2
SHA256

a45b04e8fc1fa82959c63090b5b09ab55331fb99ddafc8dd73bf4439c862422a
SHA512

6c4b43f32ea0ad99bc969714537bcf166f7d3b0f56dfcc589cf6492eb4df90a7f54a78ee9056f0407e20b36487f72e41f2c6e60b40179aaf58e5d995de6c5bae
SSDEEP

192:jbDFHpMtP5o/+poEePxfhvUy7RxIYemXvtUn4dQijqPHWnJgR+pk:P9pM0xfhvv7RyNmXvtcEQKqPHWnJgRP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2388	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2388	AcroRd32.exe
2388	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2800	2228	cmd.exe	29
PID 2228 wrote to memory of 2800	2228	cmd.exe	29
PID 2228 wrote to memory of 2800	2228	cmd.exe	29
PID 2800 wrote to memory of 2388	2800	rundll32.exe	30
PID 2800 wrote to memory of 2388	2800	rundll32.exe	30
PID 2800 wrote to memory of 2388	2800	rundll32.exe	30
PID 2800 wrote to memory of 2388	2800	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\UpdatedIncognito-main\UpdatedIncognito-main\cert\__pycache__\certgg.cpython-312.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\UpdatedIncognito-main\UpdatedIncognito-main\cert\__pycache__\certgg.cpython-312.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\UpdatedIncognito-main\UpdatedIncognito-main\cert\__pycache__\certgg.cpython-312.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a362dd1beec8fc8b616b0630ffb3e454

SHA1
28aafbb11bcbc731375897fc5d1dc3d648a9014a

SHA256
e1d65adb3b40474a608d763f047f3b19e4a06e795b5bbd2af62a9256ad481540

SHA512
a37a7e5837d959b2aeedb4342298a42e50f6b7ea86efb91eef4833ca284f872af56e28efe6800ee345681abb4164cf21fb517f89e8b6cddced8fbcb38c9e3b02

Download Submit