Analysis

  • max time kernel
    102s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2024 22:39

General

  • Target

    misc.pyc

  • Size

    4KB

  • MD5

    10908e48fecf78aebf1635fa0a3ebd62

  • SHA1

    03c779c90572da380543c51ea88415958b67fb51

  • SHA256

    e7c0fad22a8e890738c3f3f8ff82a11862b18a28bf608b37cd7759af3efd5e3a

  • SHA512

    f8a2197443e052ce8acb05685c67d9f076a169361297ccb69f598e6d101af599a1fd5b1612c53ca21e9df526c0ed977bbcb7576ff4abf359f3a795977bf8bfaa

  • SSDEEP

    96:vDh/7Y8hGPU6KGDweCPsUXBK84MCdG0fyWtUgJup1k935r:vVR3Jre4sUXBr4XG0Xds1kF5r

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\misc.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\misc.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\misc.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1044

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    09f73608278765fc8dea2571e3311ba6

    SHA1

    8dfa85bb5fd925e8c6ebde271eb74a25f1b623e6

    SHA256

    a4a102caf0925b815f489b5568c6d78f03746ebf29568e9edcce927556b54b32

    SHA512

    6adc2a3135cca25870cc717c9ccfdf3fca13d8b873551fe9f3987732b6a28e1993275a5f801c1175721f68bb71af90f6c133df981303936e446b553cdb873098

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.