d94259329e042360d48ba2d18cc630277afdaaeebf389dced4d5070831e6fe33

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/12/2024, 23:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

encodings/__init__.pyc
Size

6KB
MD5

06f541eeb6bbc9f8c08b79caa36bed40
SHA1

5cb8ebf1a95a4586cae644e1adfea5bfdfd5a6a6
SHA256

d0c5cbe76f1998ee6124fc06202c03b3c1a438e6da70291c9b134261a379df60
SHA512

c65822d22f2ab26e00c589683212da9187570768e6becff22e0fc46f880e97fda42a0a6a0999fc45ad3336099a75cdd6cb0b15d89b7c4b355c78aaeb670db26c
SSDEEP

192:mYLpFkYXqEDX29RuL0NYjxJQF00oFSD8/atGoxlUt:3NnXqWXSALSgFSDxct

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2760	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2760	AcroRd32.exe
2760	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2176	2092	cmd.exe	31
PID 2092 wrote to memory of 2176	2092	cmd.exe	31
PID 2092 wrote to memory of 2176	2092	cmd.exe	31
PID 2176 wrote to memory of 2760	2176	rundll32.exe	33
PID 2176 wrote to memory of 2760	2176	rundll32.exe	33
PID 2176 wrote to memory of 2760	2176	rundll32.exe	33
PID 2176 wrote to memory of 2760	2176	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\__init__.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\encodings\__init__.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\encodings\__init__.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
425247bb20f7ad57b8520f951cac3b10

SHA1
ddc3f319e8df1115921beb489104fb1d33daa879

SHA256
1fedab6b49ac0ada389a0ac99082a1060b566344a1ab62851368f70b6a231f61

SHA512
e5bbe1bdd49ab2949162ef6c434b686a8f17091153c3a9bbe768f63273214cf8b5440a9aadc64dab3868a835cb048971caedc47e17a10d099fab97bb47426d12

Download Submit