28c96207c968ebe43c8d075e6720a32cd757a3b89757adfd646e7e1760174583

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
19/11/2024, 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

testing/bahKV5 - Copy.py
Size

5KB
MD5

6590251f2fe64b8a7720067befdf12e0
SHA1

e806c4daaab5194db4aee47938bcd040906800a0
SHA256

a7c710381653e9de8d7167362e33929d8e83176e7abd69743d475ccbfa5ee08c
SHA512

749a4d1e53a1aa19fdf007a561c6eb03480b4eb11c4e83720ffa2f45cd2cd2b80c8597dc5b8227ba309cbe76dc8e4253003bda7875ae0b332308180793cf01ff
SSDEEP

96:P68XQ2GZyOZbNxhIi8EUrUM0/AZH8Fy7daWlCPpa89FRwkmyN6/ODiRf:CAT30YZH84hCRaOwyNAf

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2524	2360	cmd.exe	32
PID 2360 wrote to memory of 2524	2360	cmd.exe	32
PID 2360 wrote to memory of 2524	2360	cmd.exe	32
PID 2524 wrote to memory of 2888	2524	rundll32.exe	33
PID 2524 wrote to memory of 2888	2524	rundll32.exe	33
PID 2524 wrote to memory of 2888	2524	rundll32.exe	33
PID 2524 wrote to memory of 2888	2524	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\testing\bahKV5 - Copy.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\testing\bahKV5 - Copy.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\testing\bahKV5 - Copy.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1c5110297168b2078f270028a5fd7cb8

SHA1
f4d8415881c7e7c1d7a3ee7a166acfd3187e21c1

SHA256
c5b89666349fd547735349018a0341df59600fd43562081bc3c1f596b87ca174

SHA512
94072a2edb9f5237db0ed2826da88f470d98df298124ef2649e1b8c4cef06d255db576e6922f37f57e04973d9cc44ddd58fd0573daa3c032080ce23ed8c03086

Download Submit