Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    09-12-2024 23:00

General

  • Target

    encodings/big5hkscs.pyc

  • Size

    2KB

  • MD5

    6155da3d274adaf47719aea5fcbc27bf

  • SHA1

    fd4ff9b9599417f6bcc3953d0b7c5c9d4e85f47f

  • SHA256

    928f752c3884b363b7314a17beca565ceb97514331ae99984ee71a75abe79d07

  • SHA512

    3ee688f897e42ad57d17e4105288422886d5faf9da9d328dff30adc92cccc7b06eed174329de840bc5605acb62838fdcf15e3e7e6263096084fce8665672ba6b

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\encodings\big5hkscs.pyc
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\encodings\big5hkscs.pyc
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\encodings\big5hkscs.pyc"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    fc38907fc60286db2b0055ecc8d5bba7

    SHA1

    00ad3a5c178b53334ba2b5d5c3f8bd70167105aa

    SHA256

    cb1de9307df7fff4b970bb653eebc633b3474dc7c3a6446232f71d41c153eb74

    SHA512

    1108e13a61a29a28f919cf0805866b74520c58e0e9f192d59ed1fc46d8ea1cb01d7985e5ac683e347536ade7074f7ac9af4c4e2a1e478bfb11c96ddedef00dd4