88a3cc48a8bcef7873b286ecaf3a4e618dd20fd478fd9fae1634bdb5b4b79461

Analysis

max time kernel
121s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/12/2024, 11:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docs/source/conf.py
Size

8KB
MD5

e3daa910b90f3e3628d461e030728a36
SHA1

832dcbb92fc0ae4685211b55b512c8b0e2be15f6
SHA256

3222db72f2a58d22631b9e903ad93f73ca1d11868235461b4451f7d6b2d51894
SHA512

53ec02ff273ca12f92d8522e1381f83407d268fef0e4ee9845192ca762747573383625ccd8448ef274fe6892192e74979727cb4547dca69ca02e0874c1e6c60c
SSDEEP

192:Rt2LrEBrLL7trSJhjNHjFPM6iZllPBfqzzhL:RsrEBrLL7tmJhZxl29fqJ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2716	2780	cmd.exe	31
PID 2780 wrote to memory of 2716	2780	cmd.exe	31
PID 2780 wrote to memory of 2716	2780	cmd.exe	31
PID 2716 wrote to memory of 2624	2716	rundll32.exe	32
PID 2716 wrote to memory of 2624	2716	rundll32.exe	32
PID 2716 wrote to memory of 2624	2716	rundll32.exe	32
PID 2716 wrote to memory of 2624	2716	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\docs\source\conf.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\docs\source\conf.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\docs\source\conf.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9cc4912575ea3b29775ca735edd9cefb

SHA1
c37d8c4369346061f394e1edeeece63048ab70df

SHA256
82bfe2d77498202786a21382ee804c5184e82a6e86d4789136a36aea53b46f1f

SHA512
de12a76a0c9da5e13b83f6eee739c5411ad84cef13720e85df2df818d4be459e25d8feca64b7336ec0b0eef363b8aa7c88ffb1847096c3ae691317faf4cddb29

Download Submit