4e15af88aac65f1ac73a9ec2d18df57f44d37f19b38cc005f0b9daf4233d57ae

Analysis

max time kernel
103s
max time network
20s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

epigrass-1.5.1/Epigrass/CustomModel.py
Size

1KB
MD5

9a47991508f6ca5d384399f3838c7df8
SHA1

9d1c419c101802690d6c7d673c560ac97c40ea85
SHA256

0db74ecfdce1c07ecf8fc0c0ab4f1f48d636ce23c43052b57cfaf281726fd368
SHA512

4a8005ddf77011c18e65d3a2787252551d1aa2f9c2c78133ab8c5441066d962deed6a48299a265bcfd4503aa3e54f84415260b4ef1c88ffd55540fb9131b09cd

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2788	2252	cmd.exe	30
PID 2252 wrote to memory of 2788	2252	cmd.exe	30
PID 2252 wrote to memory of 2788	2252	cmd.exe	30
PID 2788 wrote to memory of 2812	2788	rundll32.exe	31
PID 2788 wrote to memory of 2812	2788	rundll32.exe	31
PID 2788 wrote to memory of 2812	2788	rundll32.exe	31
PID 2788 wrote to memory of 2812	2788	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\CustomModel.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\CustomModel.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\CustomModel.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b1871936a2adef802692cef154781850

SHA1
324d08b888fbadc469dca387568cac68d248bd1a

SHA256
b02e89c17962f590f6457dee1f0ec461eaf9a1ba898ddce84ab42f822f2eaaa7

SHA512
1c31e236283105d0629f2eebc9a63a42bf667094632b64128d081c5465e59ea0bb6d709a583a52fab72e5151ad5ea98c70c4810d8b8c23e2f2d3a107403f15c3

Download Submit