3d6bc3c0247c2b4f87282da002475ac068b5b6cac948743f697832a9a4a4c6de

Resubmissions

21-12-2024 17:42

241221-v9y3xavlaz 10

20-12-2024 23:19

241220-3bbtqawpat 10

20-12-2024 19:29

241220-x7fjwssqdm 10

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-12-2024 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

df80862d09cb2aef641db58fb9cf44af
SHA1

38e5d07ae5755c67dff69bb60a69385261810cad
SHA256

df6fdb82eca45baa6a91b89cc9aa2fe59020a28e08df90b1d060932140a658f6
SHA512

ba31801f383cca23866513f36345358f91906c31b4a711e8e36d345ba7650f112119f0f175105b7e422c6be31ce62b047f974d39863e3d753fe2563653ffe05f
SSDEEP

192:wKKt0a3nD84gkuWdXwvHCZGr6JhwZNMdwtnw:bKB6PWuviZ++2ZNPtw

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2820	2184	cmd.exe	32
PID 2184 wrote to memory of 2820	2184	cmd.exe	32
PID 2184 wrote to memory of 2820	2184	cmd.exe	32
PID 2820 wrote to memory of 2812	2820	rundll32.exe	33
PID 2820 wrote to memory of 2812	2820	rundll32.exe	33
PID 2820 wrote to memory of 2812	2820	rundll32.exe	33
PID 2820 wrote to memory of 2812	2820	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f5ad3ad3f9b6c2bfbc708e6ed5e05066

SHA1
cbf96a87a4da0a00d08df939c67cf43383ff1166

SHA256
1c32df39741247965f493d6c63dfe8478d9c770ecaf3c8f060053ec705d13d23

SHA512
7ef6cf54a80f5af6dc7c585e02544da0fda5e12dec3d32d16a1e550c90f61b2639fbcb559ee809aea7b1113000008d57c318264ab8f269c95371c8e43b53af0a

Download Submit