63366bfe1a68cfcbddb59b2ad7c1c4c5cce873fec32d2105d067a6a0548702f3

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1-18.py
Size

110B
MD5

0198828033bd8c3613d000b906dd1228
SHA1

fd85f3f468d882293a88c016cba32bcbf7d439a3
SHA256

63366bfe1a68cfcbddb59b2ad7c1c4c5cce873fec32d2105d067a6a0548702f3
SHA512

2a4f00eec9f721184b59fa670400d56079495c20dea58aa6f14afd9558bedbc0a0e0c3d10de46f7b5e01a31afdfabc11ec687ea7dc0cb2f89cac5e8554927bd2

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2728	AcroRd32.exe
2728	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 2552	2548	cmd.exe	31
PID 2548 wrote to memory of 2552	2548	cmd.exe	31
PID 2548 wrote to memory of 2552	2548	cmd.exe	31
PID 2552 wrote to memory of 2728	2552	rundll32.exe	32
PID 2552 wrote to memory of 2728	2552	rundll32.exe	32
PID 2552 wrote to memory of 2728	2552	rundll32.exe	32
PID 2552 wrote to memory of 2728	2552	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1-18.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1-18.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1-18.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
18549f1d69deb24a25c225dd74fc28ad

SHA1
0962fa62aad2255cf42d41bbe8c8f5f9fae82775

SHA256
2f7f7181ecb0f14a23453b2d18fb5430a5d7a75d5aab6dd4e96251584b1aab0e

SHA512
4eca4457064ade2c86406497ecf7d7dc21a8681ebfeea4174964edc333680b8f7cdc7983953d25f1e52bc996e8a4df4ef325fc64b8f120c5a9a314d130587287

Download Submit