838d6eaf5499fa6453b842e47d21c5e6cf6a816402a698c5dc279c3efdbec84a

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Проги с ролика/Blank-Grabber-main/Blank Grabber/env/Lib/site-packages/setuptools/script.tmpl
Size

138B
MD5

c7c13d61b7887915bfc911031126af09
SHA1

fa9b9f2e89357c8597490720b623d3b875136773
SHA256

5864ede6989eccedbb73e0dbc7a9794384f715fdb4039cfbf3bda1bf76808586
SHA512

1e115f1555da61d2ef330fde94010a0138c4d761342ea02b109b21f11f2e4ee59243b4137cb72fafdf2347a4c56ce453e239e838e446efd01a69706d25b6fba0

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2764	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	AcroRd32.exe
2764	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2304	1628	cmd.exe	32
PID 1628 wrote to memory of 2304	1628	cmd.exe	32
PID 1628 wrote to memory of 2304	1628	cmd.exe	32
PID 2304 wrote to memory of 2764	2304	rundll32.exe	33
PID 2304 wrote to memory of 2764	2304	rundll32.exe	33
PID 2304 wrote to memory of 2764	2304	rundll32.exe	33
PID 2304 wrote to memory of 2764	2304	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Проги с ролика\Blank-Grabber-main\Blank Grabber\env\Lib\site-packages\setuptools\script.tmpl"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Проги с ролика\Blank-Grabber-main\Blank Grabber\env\Lib\site-packages\setuptools\script.tmpl
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Проги с ролика\Blank-Grabber-main\Blank Grabber\env\Lib\site-packages\setuptools\script.tmpl"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
0685a9907a1467862f0d3df80a5e305f

SHA1
7c54a6a1b518ce78102c0eb7ecd775d7eba0d398

SHA256
1512d60069628259a10f084843a1d1b7ce1f66d4e594472d8b4ca8264f16a2ad

SHA512
5e964073acbcfbacaaef2e4f34602ea071b3015f02349276d764035b876f3c9b38f71c673fb2a8faa4c39e5d0207340808c24cd4f8dae950ffd7d9e20f2a8521

Download Submit