b6f677ed348de7160677ca453846e77713ba1b2e9820b03be282956626725eca

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

boot/fix bug.py
Size

89B
MD5

b1e437ddd96fc2ab66abb9ecbd970e52
SHA1

791251d935d3a2c391661f72e34cebf6eb3bd0d9
SHA256

435c86438c3ea3ce0288e5675ae7c417f3a8b60441babe170aa82c4d9142576c
SHA512

b02e1af6efc4339831d33e6df46069d7e697740a5b6028b4523502e7b6408d270ad0bad70ce28d16cd8776e1b6c025aafa376aa2b197c02ec1eb1088904310b3

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2676	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2676	AcroRd32.exe
2676	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 2832	1688	cmd.exe	31
PID 1688 wrote to memory of 2832	1688	cmd.exe	31
PID 1688 wrote to memory of 2832	1688	cmd.exe	31
PID 2832 wrote to memory of 2676	2832	rundll32.exe	32
PID 2832 wrote to memory of 2676	2832	rundll32.exe	32
PID 2832 wrote to memory of 2676	2832	rundll32.exe	32
PID 2832 wrote to memory of 2676	2832	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\boot\fix bug.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\boot\fix bug.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\boot\fix bug.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9a7f245982af477ece7ac76efb354115

SHA1
1ecdaab14c369bbf75f5b2d063ce6a60f34b22b0

SHA256
efafa815b24bd8a0296c322652ac17b8737ce140b4b2705924c5d5193d62785c

SHA512
8b1977e42ae412010a1ca86a66de419414c26aa2e62db6f43003fddc58829afd6098da40bb1edc5fa6ce809480a34a9a62137c232507ac1221e499a0254c0712

Download Submit