88de739cac5442354a41df7ff4e8fc4f223a8ff9ff87b59c13df607b491ec679

Analysis

max time kernel
1442s
max time network
1443s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
16/12/2024, 11:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ManagerOfficeTool-main/Setup.py
Size

542B
MD5

5bc2361c6419e83e439619435fa4f294
SHA1

22565380f55e5ce64ae4e2711dba560f01636308
SHA256

a6a8023577bc1336ff666927463139c4f505f2e9fea5a17f923550f77c9e69d1
SHA512

d79c072c9e4ac57b3f7eb4e97419c81d8c8ada55c0cac450b346d38641e004d90231c5644b5cafe4411d59e7196c24b0279df14c538201888e78cd982a43b94b

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2768	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2828	1856	cmd.exe	31
PID 1856 wrote to memory of 2828	1856	cmd.exe	31
PID 1856 wrote to memory of 2828	1856	cmd.exe	31
PID 2828 wrote to memory of 2768	2828	rundll32.exe	32
PID 2828 wrote to memory of 2768	2828	rundll32.exe	32
PID 2828 wrote to memory of 2768	2828	rundll32.exe	32
PID 2828 wrote to memory of 2768	2828	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ManagerOfficeTool-main\Setup.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ManagerOfficeTool-main\Setup.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ManagerOfficeTool-main\Setup.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
92b31954c463e09edf78f992bd07622f

SHA1
0d787dc32723cee368ba17e0a8bf0bbcda2464d9

SHA256
8fb5c4283d89113c2c8c12a4a3765d56cca82f937fe286d3ba9187270ee1dd9b

SHA512
cb7326776137f18fb05bf5a33ddad21830da13e6c45156b6921cbd335cc94288946c8ccdfc7402d827530e9463311e7e043924a75dfe488919f7538dd5e68897

Download Submit