b7dcd530d64dcc98af9da6f3b89d32aa6771b060c994028e6d9e41ff1da26abd

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stub.pyc
Size

799KB
MD5

a711821c22afce825c9b564004ea432c
SHA1

6bf433a7cc496c6be49f410b59c267f01759ae33
SHA256

7af14482972d9014df3720889e492a98cc08fa19e0976f84b277f2f75c162904
SHA512

333c9941192e3d0418c2cf816442c77317a180c5776ef1d41a23012e6828b164c622e79027057e10cb79e2ef13ef8095c710cc6b337c69723bb9962a61666105
SSDEEP

24576:mTfXe/2RW9pZZ3F2EHkuaOAQa32B+GA4/ThF:mVwVH1Na3XGAg

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2780	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2780	AcroRd32.exe
2780	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 2700	2816	cmd.exe	31
PID 2816 wrote to memory of 2700	2816	cmd.exe	31
PID 2816 wrote to memory of 2700	2816	cmd.exe	31
PID 2700 wrote to memory of 2780	2700	rundll32.exe	32
PID 2700 wrote to memory of 2780	2700	rundll32.exe	32
PID 2700 wrote to memory of 2780	2700	rundll32.exe	32
PID 2700 wrote to memory of 2780	2700	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Stub.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Stub.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Stub.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
285770b33b2b16d44513f7675226cbae

SHA1
93c4c9817656eceeee8784894373c250145b6820

SHA256
1b750857c120c5ae367709d81b57e7ec67ebd11f531da40713845a3a8f8dee8e

SHA512
b67119362e140ab150241e468b943b1d378a35322d3155d37da945e121676243fde0cc8928cb088c65de156d2f4e0af466b6e42f34302c7326f2e0e92a7ff5ca

Download Submit