4d5e9a81aaec53df6bcade23ae5638527224affdfa165c72fe16299131bb1450

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SilverBullet.1.4.1.Pro/SilverBullet 1.4.1 [Pro]/lib/email/_encoded_words.py
Size

7KB
MD5

be20289144f59d1f35307cb1391c420c
SHA1

2d354e3b167a8862e4090b62f37a0ce255dd3862
SHA256

6fdd988fb6d21d3101f51cbb435b8b8d5f211a71380dfca99bdf9f77a1ff2e52
SHA512

3d9fc8ad0d04cb496d66ba7b372654e0e386b8bcec91da4d54f07eb441e6aa1ee83bd901f82e88c42d5158ce0484d687e1cff8ba4fe48cb52c964de3fcb76eda
SSDEEP

192:F2gPi1IygNGmdRBp8+HAemBzJkpVkgnrVe8ONeU8SnN2ENGKTK:F2gPimygNGmjUTsVkgk8O4l7Eh+

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3000	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3000	AcroRd32.exe
3000	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1764 wrote to memory of 2688	1764	cmd.exe	32
PID 1764 wrote to memory of 2688	1764	cmd.exe	32
PID 1764 wrote to memory of 2688	1764	cmd.exe	32
PID 2688 wrote to memory of 3000	2688	rundll32.exe	33
PID 2688 wrote to memory of 3000	2688	rundll32.exe	33
PID 2688 wrote to memory of 3000	2688	rundll32.exe	33
PID 2688 wrote to memory of 3000	2688	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_encoded_words.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1764
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_encoded_words.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\email\_encoded_words.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9675f55afd86e7b0199d30bd50778075

SHA1
fef27a56a681962652a49c1c05f67ee7d50ce6fe

SHA256
0031cad60650782ea8a963c32b8e3c8fbe5e9c3f08363e257a6fa34db20d8d19

SHA512
17f86f899dd76acccdc1f97896025cee8370bcf799006292ff6991e1e1a55230ab82414f628a6338b1e81e2eb5b31b71ca1393f2c2c8392325438ec01c5597bf

Download Submit