dc007eedcc5771b76b7168e4be1c6b4f9b5a38cc358e94f9efe3ee53d245773b

Analysis

max time kernel
102s
max time network
20s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16-11-2024 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Condo generator/Components/BlankOBF.py
Size

5KB
MD5

b3d2f59792b99d98107717d6b7100cf3
SHA1

5cf1f176236fb12fd665301a64be7d883ca125c8
SHA256

73bd45bbbf96aa84a2abf5eef93513126bd3adbbbb5ebd5272776643d99c1fb8
SHA512

1791b325ea86c56d35ff9c9216685dd7b3d0b0d01538de5cb6310cb64750daadbeccddbe51fc985bb22a8d8e67ab1a180708e7b97441e0daa2c0b1c14e918ed8
SSDEEP

96:Fr54cd62hK9FFZ48PuCQYBX5oQL6oUMOQcL:FP6Us4B8JoQLBsQcL

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

AcroRd32.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe
Modifies registry class 1 IoCs

Processes:

rundll32.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings rundll32.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2640 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2640 AcroRd32.exe
2640 AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

pid	process
2640	AcroRd32.exe

pid	process
2640	AcroRd32.exe
2640	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1656 wrote to memory of 2764	1656	cmd.exe	rundll32.exe
PID 1656 wrote to memory of 2764	1656	cmd.exe	rundll32.exe
PID 1656 wrote to memory of 2764	1656	cmd.exe	rundll32.exe
PID 2764 wrote to memory of 2640	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2640	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2640	2764	rundll32.exe	AcroRd32.exe
PID 2764 wrote to memory of 2640	2764	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Condo generator\Components\BlankOBF.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Condo generator\Components\BlankOBF.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Condo generator\Components\BlankOBF.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
69decc1c591768eaf2e1f4c3683dbf9e

SHA1
005fa528bf6b1fa714435a134544f748f367b2c3

SHA256
a295a4f50fa44d2a8bd67963dc623dbb500b08e976a754a1c51383e96c50b7c1

SHA512
8c3b1043a96d89b912b2bf7770b76aebdb48854fff8dd7d7fcde70db8248fd147017255382993c63a4591ebb97e46d348a92432073b10abf9548c7e8b479b79c

Download Submit