a99de695bdc022b6ec1f08b810f50bacf9d1795b0fb30046123a19c47c4cf086

Analysis

max time kernel
102s
max time network
23s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-10-2024 17:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 8.3.230608 (x86, x86_64)/python/examples/core/colorize_disassembly_on_the_fly.py
Size

4KB
MD5

55cb47e462545e94e8dfbc8fdae966e8
SHA1

9eccbb1f3e4034e7018a2c853f5cdfba4eb0e5c1
SHA256

8c132712f939b62a6968d1d090bffead60a0af40f20577332481388c82a90610
SHA512

210dadf41ae6056ef550fb5050f28b59c53400680dd8eb1ec31e094dc6f6bda14d44ff706bb4e3909d08e89a832dd7e5f8661613a73b9c46d6bb238db7b2485c
SSDEEP

96:tpn+1o/bgS0xbcWK1fMF7q2isrmRBgivo25YKZVcT3XB+qWoE4Ql8F:/noo/cnwWV9NO5uTE4S8F

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2860	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2860	AcroRd32.exe
2860	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 576 wrote to memory of 2876	576	cmd.exe	32
PID 576 wrote to memory of 2876	576	cmd.exe	32
PID 576 wrote to memory of 2876	576	cmd.exe	32
PID 2876 wrote to memory of 2860	2876	rundll32.exe	33
PID 2876 wrote to memory of 2860	2876	rundll32.exe	33
PID 2876 wrote to memory of 2860	2876	rundll32.exe	33
PID 2876 wrote to memory of 2860	2876	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\colorize_disassembly_on_the_fly.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\colorize_disassembly_on_the_fly.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2876
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\colorize_disassembly_on_the_fly.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4d84630169da414dd757153411afaff0

SHA1
5737eacf42160fef3ac0ed22a17ce0235f60efe5

SHA256
000282df3991cab04754681c604e09798ad7e2bee1227047b07c08ab3bbd9e30

SHA512
14ae191d5130960dde4238af90d8c31c5bb961064edd1d7c85c602905fd87d1ea4578617d0eb7763ee9d3a062b67d2f2642202bdb84de79837fcc3dc23b08593

Download Submit