e5e4bc9b97c9c6fce7178373bd1d6e6204aeca5b0e9af8100cdbcaea9b8a8020

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

capesolo-0.4.11/CAPEsolo/capelib/cape_utils.py
Size

4KB
MD5

8a2fde84caf9537ed4b4708ab42e148d
SHA1

590d2c0ba556a119fb68f96d49e5fd4010964537
SHA256

6a0918bd458e61d3c04348f9525fe90f54f3e913ece56e9c0beaca62b13d5d1a
SHA512

d90aa4d9ae8e24e1ec8b707ddd2b30caac638a253a22067885dfa110892ed3d6ffce1f4e4d9a6837f4946cffad33bdeffb2ee4434d768e44fed5b2e78d6ca423
SSDEEP

96:nz+zfF0Y568dv5N1iiYcWKZPVgZH5gSDJstdZFKmBMj/m/:nzYfFHpRriRBnJst4muj+/

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2916	2260	cmd.exe	31
PID 2260 wrote to memory of 2916	2260	cmd.exe	31
PID 2260 wrote to memory of 2916	2260	cmd.exe	31
PID 2916 wrote to memory of 2604	2916	rundll32.exe	32
PID 2916 wrote to memory of 2604	2916	rundll32.exe	32
PID 2916 wrote to memory of 2604	2916	rundll32.exe	32
PID 2916 wrote to memory of 2604	2916	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\capelib\cape_utils.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\capelib\cape_utils.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.11\CAPEsolo\capelib\cape_utils.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
acc422359e3b26cc46df0bd9584efcd0

SHA1
b12f7c7b41376b7a5829c1d2a750111246162095

SHA256
306b0afeed684c2942bacfbf5d27aac29ab8ab8d68bcf147f288b7a28b44b01f

SHA512
651f4ea7f2251359d53a346de723299710f786cafdfc85981d344545586888ee29842cd19484402585f34cfab117978a743a1fd18a6d29374e2357fab832ddd2

Download Submit