4d5e9a81aaec53df6bcade23ae5638527224affdfa165c72fe16299131bb1450

Analysis

max time kernel
117s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SilverBullet.1.4.1.Pro/SilverBullet 1.4.1 [Pro]/lib/doctest.py
Size

104KB
MD5

f9cf4c1e521bae3919a1c48b91c63e56
SHA1

e29f805043cd126ff46615bea73a8961b7b98b88
SHA256

b552a5bc0a6262d2ad4edb5b7022f5cad15de9a35f144978184260d2ee447a62
SHA512

6266dd639efff83b4f899f413bf796626b82e77b5e33edee4afc3186e845ba0ba787259ad5d079fff4c1f4ed1a584f8288d12c7cd5f211cf718a1b89087d4866
SSDEEP

3072:k31db9Wi0veFhoWYsioJT0a+/Fj9sjQeO9xnVUaH8e+t0T+2m:odb9Wi0veFh7YsioJT0a+/Fj9sjQeO9M

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2992	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2992	AcroRd32.exe
2992	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 2800	2528	cmd.exe	31
PID 2528 wrote to memory of 2800	2528	cmd.exe	31
PID 2528 wrote to memory of 2800	2528	cmd.exe	31
PID 2800 wrote to memory of 2992	2800	rundll32.exe	33
PID 2800 wrote to memory of 2992	2800	rundll32.exe	33
PID 2800 wrote to memory of 2992	2800	rundll32.exe	33
PID 2800 wrote to memory of 2992	2800	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\doctest.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\doctest.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\SilverBullet.1.4.1.Pro\SilverBullet 1.4.1 [Pro]\lib\doctest.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
91d4245ce701ee0d44234d76eddc84b0

SHA1
5df40bbb40e52f7c8435c3e6f95f64fd0b780172

SHA256
c1bc996f2f41107ba36d13d107abfd7fe7df8430ac88ee7cc4ff716c72fc934d

SHA512
8729fa368ea3af131026eff251caa5b7ba61cc4c8377a87468166d903af14659545f026ce7f675f0c5021bfaa668b1f56b0c8ab0739b521d548422a852806936

Download Submit