Analysis

  • max time kernel
    117s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04-10-2024 11:36

General

  • Target

    SilverBullet.1.4.1.Pro/SilverBullet 1.4.1 [Pro]/lib/distutils/version.py

  • Size

    12KB

  • MD5

    ba66f49f5cb1e15deebac1f92bf6753f

  • SHA1

    91389e65fb7930058c0d3bce244a16b7ab89130c

  • SHA256

    56ee5445d036b16bf887f2b71270b9dff26b395670ed73bde3124a692953bbe5

  • SHA512

    972d1058243ce3d4f239fa6805cbdc55e0bdf0db4b4c16fb34f7c8403d59d6500574de773866e889ee5cf3d63749da48777d6f1598cd99032d35d9aa303ce2c3

  • SSDEEP

    384:FJ/zIVlTJJZUno7SoVfwhZBFJucReV4f2:P/Y7Tmo7S0fIZBPucIV4f2

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\distutils\version.py"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\distutils\version.py
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2312
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\distutils\version.py"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1984

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    21a5ee05b9a6653c391a9804e272c1ca

    SHA1

    e2fe8ace5394563bf10a8d8eeecd6bcb5ecf58a2

    SHA256

    97067bdc2a655ca02cd71edda955ac673e73c5373ba4f8a770ce1211a03acacd

    SHA512

    e90396fcb93e22938b36402f5dc156c69863816bf4c7e51e6bb956ec000e8b5caa9516286a5f48299ec3dd22932d4418d76c8deca1306e3a390663476adba53a