a99de695bdc022b6ec1f08b810f50bacf9d1795b0fb30046123a19c47c4cf086

Analysis

max time kernel
122s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/10/2024, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

IDA Pro 8.3.230608 (x86, x86_64)/python/examples/core/custom_data_types_and_formats.py
Size

8KB
MD5

b2ecc15fcdffbd40f824774344f43350
SHA1

2220027851608b9989b1d91720f481a0da9c416c
SHA256

8ca929999d06f7384155a3395a2d41a4708dc68277ad2add34fdee8bc63735d5
SHA512

eb831b0a82c045513c467a83a637b065a826bd2a3d5f571f3eab85eb2038f7a029be5e8efde42cff87d6b8314809bff9c54c350ad807ab44a333df9ef16ae602
SSDEEP

192:eFglz5CsDtCBq+5JOxp2B/OmJGzzXcd95/Sfot2ST9Jgk/7SXIvDXIXXIfh:MMCBqkgD2B2lzG95KfqJlzwIzInI5

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	AcroRd32.exe
2560	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2828	2220	cmd.exe	31
PID 2220 wrote to memory of 2828	2220	cmd.exe	31
PID 2220 wrote to memory of 2828	2220	cmd.exe	31
PID 2828 wrote to memory of 2560	2828	rundll32.exe	33
PID 2828 wrote to memory of 2560	2828	rundll32.exe	33
PID 2828 wrote to memory of 2560	2828	rundll32.exe	33
PID 2828 wrote to memory of 2560	2828	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\custom_data_types_and_formats.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\custom_data_types_and_formats.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDA Pro 8.3.230608 (x86, x86_64)\python\examples\core\custom_data_types_and_formats.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4cd5c5dcb1e95b0160f156795e7f9efa

SHA1
b1a2abae9070cf531a2dd892f0f8bdde7c9f4332

SHA256
e32935e55359e12a8630053c31f427a6310e0eca6a220167fa527f287ce66977

SHA512
5377e8f33f381c17612fe1425e20b0c4726df3e76291c431bd794675089e92064c3e4909291a71ac310f033f936e3b9433a7f1d3840f3319e3f01e9a167f6cba

Download Submit