5641362511a32a806a5bf59e45b34628917e5ecfcc9fa48b8468c83811098467

Analysis

max time kernel
34s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 18:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

passwords_grabber.pyc
Size

4KB
MD5

2708355598eb0672737d920607575511
SHA1

e8b93285b34b38f3cf74f6f41e83c49eafd041e9
SHA256

81a588db8c8a2955c652490ef5437fe09863eec99cddf3b9f74aac13c87ceb8c
SHA512

9f94369adf7232e01a73bbf65acb17ee6d8f98512943ff8b9376e5e7c1fa70d30548443922336aadca48e76545b54a6cdb6081d73ee07b6353e80d916793a0c0
SSDEEP

96:CAPDnTWe0h+2PvgWxU2F7D+x3vv/qXO6oaL6N3UU63X9k68RgKlvM7CrBwApGq:vzCXh+yV56lv/qFtIEUS9wM7CrJpf

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2844	AcroRd32.exe
2844	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2936	1936	cmd.exe	31
PID 1936 wrote to memory of 2936	1936	cmd.exe	31
PID 1936 wrote to memory of 2936	1936	cmd.exe	31
PID 2936 wrote to memory of 2844	2936	rundll32.exe	32
PID 2936 wrote to memory of 2844	2936	rundll32.exe	32
PID 2936 wrote to memory of 2844	2936	rundll32.exe	32
PID 2936 wrote to memory of 2844	2936	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2936
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\passwords_grabber.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9ad610fea33eedcf55a220550d3612fa

SHA1
203e703f87f82bdeb2d776e5e1d33cbff8f48731

SHA256
916bda81dd3dd4c85046e5e27539567f76435541f7c7e17245d9285c2fc3b761

SHA512
b07674614bdfa4481697252ef5ae6db306b732998c5615d0f8e4a1c881cdcf3bda4d0d42dadf07b4ee968608b09ff7c0ba838921a2895298ae7297668ca55264

Download Submit