d6fbe0afe56a6f804f8a9d0a3e77937a409f9c15aa04cafc3a8ac308fed7d4e4

Resubmissions

22-09-2024 05:34

240922-f9g23atfrj 10

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-09-2024 05:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

a7c7b0ea0b1afd03681b155047b34c3c
SHA1

30acd77444530dddc079ab740ecd7917f464afbe
SHA256

2494d8018c64e25ea1b1858a21dea451c1c7e18f89195ed8447ca55c1ac43301
SHA512

51d57cb33ba28524103e1e261a05285c45ae506e55f25c0f39ebc3b9a61c4b53c7f4ec91b23660830b8bd15158d4a9fec6d5f72fa4ed4967297bbff5f1ffe1bb
SSDEEP

192:wJsD80tuWdXw4og1ksDJhwvgcxoMdwOM6nw:XEWuQ1kS2vgcxoPww

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1892	AcroRd32.exe
1892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1348 wrote to memory of 2576	1348	cmd.exe	31
PID 1348 wrote to memory of 2576	1348	cmd.exe	31
PID 1348 wrote to memory of 2576	1348	cmd.exe	31
PID 2576 wrote to memory of 1892	2576	rundll32.exe	32
PID 2576 wrote to memory of 1892	2576	rundll32.exe	32
PID 2576 wrote to memory of 1892	2576	rundll32.exe	32
PID 2576 wrote to memory of 1892	2576	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1348
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
69459159113d9e61a89b388f481d9879

SHA1
05f1258c982f16b09a1a25ffc1d0cb0d7bec4f03

SHA256
209dc3787dde154f9e83fc0739653d3a7c31260e0daed0119c41dc188641ba5a

SHA512
76ed822f0705c2bde78f94425a0c198d5e6a081cae1f830d77e90e44f7fa3815fe5141088f9c0fac851449de687b864af9b6dd25517c3447bbb33a2a220bb56e

Download Submit