40d3db4f7a657dd55aff0ddeab025f6d996ae7358c241b6ac5158d35235b90cd

Analysis

max time kernel
835s
max time network
837s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/01/2025, 22:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Rebomb2AYOP/ReBomb2App/fonts/__pycache__/__init__.cpython-311.pyc
Size

274B
MD5

7d9dc3107b3be1ac327413f258e53d16
SHA1

70e698df3719ceef8a810f138bacb6308b6a8e89
SHA256

b0d58ab7331007e4e9d9f0b2a805033d5f7b06f4568822520eae7e750fc7b4fb
SHA512

39463a1de91addedf5e2c3f636d18fdaebf9bb3d175a34d8b096ee97b4ac82d746274ad60908a10dac7e8e63413aca92a8ad3b6a0c061c6773f5318f127b9322

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1804	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1804	AcroRd32.exe
1804	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2576	2664	cmd.exe	31
PID 2664 wrote to memory of 2576	2664	cmd.exe	31
PID 2664 wrote to memory of 2576	2664	cmd.exe	31
PID 2576 wrote to memory of 1804	2576	rundll32.exe	32
PID 2576 wrote to memory of 1804	2576	rundll32.exe	32
PID 2576 wrote to memory of 1804	2576	rundll32.exe	32
PID 2576 wrote to memory of 1804	2576	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\fonts\__pycache__\__init__.cpython-311.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\fonts\__pycache__\__init__.cpython-311.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Rebomb2AYOP\ReBomb2App\fonts\__pycache__\__init__.cpython-311.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cef0ff022ba828e1eac0bf42b5486e85

SHA1
0371a9530efd62e28fe8043a562451cdb226aeca

SHA256
c4c6d57550f767de86e600291690fa408e7ce0f8a2b5632be15fd2de779b6cc6

SHA512
d12d30e060ef2f4f26338911a4227c1b755d47b6434287a6f4723d31689f34166bf34d635d0e134f22c9ecb44cacbd84ccfeb521d5d4d9b96993bc45b679b64e

Download Submit