b65314d02faa66713e2c3352fb89996c4b69d6377d867d4227fe8e8dbcd9e6f6

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
20-11-2024 01:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

capesolo-0.4.13/CAPEsolo/capelib/logtbl.py
Size

20KB
MD5

eec1a1f981e6d1c7edee5c3ade06a1e0
SHA1

315aa961b3c1b90545b47dde2796fd54d570b1e6
SHA256

cf17876076991dfab8932829f7887a1d51971edcf3d726035c232914660dfdd0
SHA512

1226f6c2aeed7ff6509a92b56b722566352ea391d9ea0f445b80556671374bade6668d5b24f992675695ff83bfc121253207b95c843f67842fce84d0164e2cea
SSDEEP

384:Z0sxaDn7cgB1lTmiudxjzqKc60IjyDcvyXYuEW34Ec+45saLS1sUxX6h6cp5c:+satTmiudJqsW4KlaOG6L

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2820	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2820	AcroRd32.exe
2820	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2836	1624	cmd.exe	32
PID 1624 wrote to memory of 2836	1624	cmd.exe	32
PID 1624 wrote to memory of 2836	1624	cmd.exe	32
PID 2836 wrote to memory of 2820	2836	rundll32.exe	33
PID 2836 wrote to memory of 2820	2836	rundll32.exe	33
PID 2836 wrote to memory of 2820	2836	rundll32.exe	33
PID 2836 wrote to memory of 2820	2836	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.13\CAPEsolo\capelib\logtbl.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.13\CAPEsolo\capelib\logtbl.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\capesolo-0.4.13\CAPEsolo\capelib\logtbl.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f432bd586ee0675361bab4f451acbcb6

SHA1
b2a36b1982aa90a921cfec6479a93496498b339e

SHA256
385985cc857051b87be63915522536171395d1dbc831aad51d5e1edfc371339a

SHA512
91329b983f06a19749b006b073c890f704ad12166ec6b51a993a2c0a9896091d2d0b63a93003262d26c5cf660e2fba2f2d7ac6652c42d57be583b85d5dcb942f

Download Submit