ad69e83f7ff54cd47b06f55e2ec55612f64ca77f5e8b6a77ce50fb588ed66eb7

Analysis

max time kernel
121s
max time network
132s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
26-12-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

HydraDragonAntivirus-main/website/nochracter.py
Size

561B
MD5

fd55e6a7a416698308cb77d1c9e385ea
SHA1

13beba55f5e2ec8a3998d01c59ca509a53ec0fa5
SHA256

837a74459c486c1d90bca950a2561a1d1eaff734275222f11ca12472eb4cee7e
SHA512

4d8d28c6a9d6a1706e3158ab3d8c9f30ac4d1fd84ca9cc61256b43718b73fad2f1cc5c24760473f39cc01e21c7e127214e17c7ae8c0d908eefea23623609da97

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2720	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2720	AcroRd32.exe
2720	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 1232	3000	cmd.exe	32
PID 3000 wrote to memory of 1232	3000	cmd.exe	32
PID 3000 wrote to memory of 1232	3000	cmd.exe	32
PID 1232 wrote to memory of 2720	1232	rundll32.exe	33
PID 1232 wrote to memory of 2720	1232	rundll32.exe	33
PID 1232 wrote to memory of 2720	1232	rundll32.exe	33
PID 1232 wrote to memory of 2720	1232	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\HydraDragonAntivirus-main\website\nochracter.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\HydraDragonAntivirus-main\website\nochracter.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1232
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HydraDragonAntivirus-main\website\nochracter.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
39a113fc76717032940032be7fd93f1c

SHA1
87cb31ece95ae4761bbc78b37895fde021fb0332

SHA256
5d6f2e13da95a3cc68330d38007f242dd609463dc551a06549afac13ab46896e

SHA512
f836209fff7381374d6f1c11a5077b846cdbad45ae2435a5770934390cbe9b52c6b0f20d6fe5fcd5790a90f21bb51cefb382b1d0d0c099de3255708ecab88135

Download Submit