4e15af88aac65f1ac73a9ec2d18df57f44d37f19b38cc005f0b9daf4233d57ae

Analysis

max time kernel
117s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/09/2024, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

epigrass-1.5.1/Epigrass/dataObject.py
Size

1KB
MD5

adc372816c0f3b0e6b5dc42e6fa65eb2
SHA1

ec921a1a1d71fe77d88dbf9aabe9a574feab513e
SHA256

af73bccd060d47f990651a5bb2df305b9d444593ed13d4a4c4ac115764444499
SHA512

f69b86e498d0ccf3eb7abe9e178e7d574cfb7e335c3f2321948b301db996a2873d208178b549c3d98a08c597ff550f16402a3e9209cc8d9bb6063888b7152862

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\py_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2788	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2788	AcroRd32.exe
2788	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2564	2228	cmd.exe	30
PID 2228 wrote to memory of 2564	2228	cmd.exe	30
PID 2228 wrote to memory of 2564	2228	cmd.exe	30
PID 2564 wrote to memory of 2788	2564	rundll32.exe	31
PID 2564 wrote to memory of 2788	2564	rundll32.exe	31
PID 2564 wrote to memory of 2788	2564	rundll32.exe	31
PID 2564 wrote to memory of 2788	2564	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\dataObject.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\dataObject.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\epigrass-1.5.1\Epigrass\dataObject.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
691e75a8a2f03427cf66dbdae1c28d8e

SHA1
fbcd9e4590fb7995b0de02cd839b5dedd837715c

SHA256
1dea8822fa15ccf02e688cab92c90c0e999aa059092c64fb5d32ade95848843e

SHA512
46325a105905bb41fd2d00148a4cd3bf3d750413ef574c9414377869753c6c705cdd137a7489d2e2f7a05ccfed093544b56eafcc69383ad84089499b5b3e3c9e

Download Submit