6287c1d00f8e1777bd47c273c7dea2438321a5147aa0b9d722a8671718701cc0

Analysis

max time kernel
1558s
max time network
1570s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-11-2024 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IDA/python/examples/pyqt/paint_over_navbar.py
Size

2KB
MD5

e2a7f32cc5673ea08ad321cee4ef97c3
SHA1

0606157c6feba4459078b96a007536c4e05b34eb
SHA256

1bea14310900ef27a9241d12f028bb29c80565e7c2af985184a34fc7cee9b31d
SHA512

8b01b1abb1a09efdbd9370aafe28524c3ee9f48431dc528fc618607cc745359b266b9108e85a10d1084885b2c8ed3aba7cb0b032027517edcf894d14451b6230

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2900 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2900 AcroRd32.exe
2900 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

pid	process
2900	AcroRd32.exe

pid	process
2900	AcroRd32.exe
2900	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2180 wrote to memory of 2848	2180	cmd.exe	rundll32.exe
PID 2180 wrote to memory of 2848	2180	cmd.exe	rundll32.exe
PID 2180 wrote to memory of 2848	2180	cmd.exe	rundll32.exe
PID 2848 wrote to memory of 2900	2848	rundll32.exe	AcroRd32.exe
PID 2848 wrote to memory of 2900	2848	rundll32.exe	AcroRd32.exe
PID 2848 wrote to memory of 2900	2848	rundll32.exe	AcroRd32.exe
PID 2848 wrote to memory of 2900	2848	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IDA\python\examples\pyqt\paint_over_navbar.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\IDA\python\examples\pyqt\paint_over_navbar.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\IDA\python\examples\pyqt\paint_over_navbar.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a6a2573bb28c69e842896a74b92a53ee

SHA1
253725d763efb157b0af2aa2ca166efbae6e1648

SHA256
97143937cb7b3ec1cdb89bcfea05cf50cb0c8863d5c44763f70388a43a5ad0f2

SHA512
27660049efde3995a34751e6d8a3004542b47f27ae19f2354421587b9020acf788fe41deaac48be4fdeca8fdbfd34dc75d845f70ed7cdf22d9486e9875350ffc

Download Submit