39c4afc796f6730ec8da841d1aec05f2c3e87424952f6e85049a98f66edea31c

Resubmissions

30-12-2024 21:29

241230-1bxp3szkaq 10

01-12-2024 13:51

241201-q58dkasqaz 10

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

c26ca850b8027b5e4e28a7000145afba
SHA1

1c3dca23fb11230d0f7dae9bd3d5a4852f409d06
SHA256

9d2e1266a391fe12a9790d3d2a9f7835ed06f7f50323199c8e3cb19a6f5c8969
SHA512

00a8ee251199d238fba3ac529b0e1c53ec6e63e135a01d1181b312efd3cd69492c5f6acd69ef89cb6abc621e7eae3f86324f06772a535aa096af7f09f410e45c
SSDEEP

192:wzcA2D848O1WdXwJ1G33Fi5JhwDk/MdwIxnw:jsyWuJ5z2cPIxw

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2712	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 2400	2072	cmd.exe	32
PID 2072 wrote to memory of 2400	2072	cmd.exe	32
PID 2072 wrote to memory of 2400	2072	cmd.exe	32
PID 2400 wrote to memory of 2712	2400	rundll32.exe	33
PID 2400 wrote to memory of 2712	2400	rundll32.exe	33
PID 2400 wrote to memory of 2712	2400	rundll32.exe	33
PID 2400 wrote to memory of 2712	2400	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
39c0cfaed874504664383cb466612e9b

SHA1
9116248d7dd2ee098ea3f5ed9ffe2f694eaa4709

SHA256
853ba00c96732481aebdb560d5cd5ff2fc7df8710cb2633aa4c1ccd1983159a4

SHA512
7c9837a9699e1d3c9e0a9d8a0cbf6c10df77b1c21dd7d8183a1d0b8875968531cb91b4ef0738aa01325196f87c10f5acf95e1e1c0b9e5304371398b57a062ab8

Download Submit