2ecbb7bc7319ecdcb2d9d4bbf38deabd2a3a93999e02f595d9413bb4b9767171

Analysis

max time kernel
120s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

virus/resources/nitro.py
Size

344B
MD5

c8da61d14ba6f678299a245425342120
SHA1

02c2eac1ac13a41e9e228ed208699e18ed78df65
SHA256

c20d3ef3f674052b2782d3db3e6173bdb2d962f769dca3243f18bd4db6d01096
SHA512

359ccf0702403394dabc6d5c5b5c18293ff32bac4bab8572dbab824b68ef3ba8be89c392f3c2ab522d1b53b648e911733c9e77951bc282dfa3037576b940869c

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2800	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2800	AcroRd32.exe
2800	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1576 wrote to memory of 2316	1576	cmd.exe	31
PID 1576 wrote to memory of 2316	1576	cmd.exe	31
PID 1576 wrote to memory of 2316	1576	cmd.exe	31
PID 2316 wrote to memory of 2800	2316	rundll32.exe	33
PID 2316 wrote to memory of 2800	2316	rundll32.exe	33
PID 2316 wrote to memory of 2800	2316	rundll32.exe	33
PID 2316 wrote to memory of 2800	2316	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\virus\resources\nitro.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1576
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\virus\resources\nitro.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2316
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\virus\resources\nitro.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
13343d9fc88b925f3fedbc88414698c5

SHA1
90a1b668d72de40935002ec2a673ede884557a33

SHA256
49d9c87c65ca285c016fe0681a17523c717c5b5c46c418cd7518a098dccb20f8

SHA512
8324cedf0b0f68ff1a947232886b9a2946328f81250e9ccfa29aa5699743048ecf54dc60ae4ee2c687454044d5d7c3de6d737a9f54bb52aacc77756fb7b4e9dd

Download Submit