a6643508f9a45e08bfede83306e5d3676ea859c19a7a796456984c35fb3c482a

Resubmissions

24/12/2024, 16:28

241224-tywb7s1qat3

14/12/2024, 01:02

241214-bd5q2asmcz7

10/12/2024, 00:03

241210-acches1ncp7

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/12/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
main.pyc
Size 7.9MB
Sample241214-bd5q2asmcz
SHA256 ab3c63ce035e095a909a733bdcae9952c2ddde137777edd79369ebcd3f8f1959
MD5 9e50c866df672ce07e371975874b1e80
SHA1 23b74b67e8354ed0b9cdbf14b1c5e3cefe61abc8
SHA512 e400c9f98a84becfedcdc4c97a69b862e3d76f181be8f22a94f064e769bf731a22220dc6594e18b497638ce9bc77de16d3b3ecdd10bb95bdf649355214d876fe
SSDEEP 49152:A7lmgKSwPsMhMUHfWNPQBJ7rtyI4E6DpaBmWlfN77FYV3OQ/+2vFGk+swa2jDmOz:aRa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2076	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2076	AcroRd32.exe
2076	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2980	2356	cmd.exe	31
PID 2356 wrote to memory of 2980	2356	cmd.exe	31
PID 2356 wrote to memory of 2980	2356	cmd.exe	31
PID 2980 wrote to memory of 2076	2980	rundll32.exe	32
PID 2980 wrote to memory of 2076	2980	rundll32.exe	32
PID 2980 wrote to memory of 2076	2980	rundll32.exe	32
PID 2980 wrote to memory of 2076	2980	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 1ff4b8b8f8d334f1496a4cd613527e83682e45e01020c46f82b029b1efa987ec
MD5 02bc56361d32b7254f9f2007488ec7a9
SHA1 6104d2c89e45afc6411fa82313a49fe9ab1b21b5
SHA512 d2bc44ef0dcd625ec3dee304ec1641e697833289ec127bc7047aae4c20ca21fb8e88ac8a061c9e5bfcbacbf59858d20fde224c2d1ebe8d57c6652894a4690697
MD5 SHA1 SHA512

Submit Download