7b4397881e2d433bc3b3df9b7f62aaa08265cf6bc8323f934662a961bb377e0b

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

162KB
MD5

9fb4ae2cae1c7e1b08f35950ffc0f838
SHA1

aced8b98b79db76e073af44d16e1d9d54f01a622
SHA256

a13d5523f527901b66de0310157b7e42db15f1db3590c13ea891a0436ec6f075
SHA512

b376fc2efb43ee1f46dbbfc881e2e8d973dbdb0d1f8d376b2b8241a3fd6dec929945e8cb7519a72eeb4950039a65a8c8d0f1d5d14cd525bd0a337494396124b5
SSDEEP

3072:JxXLaSU1/jRUYo9PEtelZN+hoJgIgWOSHCkIE:JNWS+2Yo98cN+qJgIgWOECO

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2596	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2164 wrote to memory of 2748	2164	cmd.exe	32
PID 2164 wrote to memory of 2748	2164	cmd.exe	32
PID 2164 wrote to memory of 2748	2164	cmd.exe	32
PID 2748 wrote to memory of 2596	2748	rundll32.exe	33
PID 2748 wrote to memory of 2596	2748	rundll32.exe	33
PID 2748 wrote to memory of 2596	2748	rundll32.exe	33
PID 2748 wrote to memory of 2596	2748	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2164
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2748
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f5692d5fff0d77ad95633e56ca3302c7

SHA1
f36bf716b94897403aacf9300173481f7a5bc73f

SHA256
992c57ec04e41d7499a93576ce339a5e39e4d2d38d74f8585bc61e4485db8485

SHA512
7f27c7832641096c937d3d18ccba2ef1bc45b9be111a414b26eda21e2dffa402f01ae8118a5b7e0530077985aab130ff729c70f4745faff4cbeedf9a6f3939e9

Download Submit