be86b8210011212f3bf52f0472652ac3bbe2663bc021c2a3c3582670dddd1592

Analysis

max time kernel
102s
max time network
18s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
01-01-2025 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Xeno-Executor-master/expense_tracker/expense_tracker/doctype/expense_record/expense_record.py
Size

318B
MD5

916d63bc1db7ccea646331c643af55d5
SHA1

2de7d1c8727fd390ffbb3a05e61831db07cfaa00
SHA256

12005cb829ee325ed47aa26180cf1b5eca229f72b268e04b3034ed90e0bcf475
SHA512

478295f9fffdc6898814ca4d9c040fbdc65e29704ab5d8382ac9bf16b5b46432424807f24418043f34462088b10c6188846b59ab3626d44448ade36b28609f84

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2804	3052	cmd.exe	31
PID 3052 wrote to memory of 2804	3052	cmd.exe	31
PID 3052 wrote to memory of 2804	3052	cmd.exe	31
PID 2804 wrote to memory of 2812	2804	rundll32.exe	32
PID 2804 wrote to memory of 2812	2804	rundll32.exe	32
PID 2804 wrote to memory of 2812	2804	rundll32.exe	32
PID 2804 wrote to memory of 2812	2804	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno-Executor-master\expense_tracker\expense_tracker\doctype\expense_record\expense_record.py
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Xeno-Executor-master\expense_tracker\expense_tracker\doctype\expense_record\expense_record.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Xeno-Executor-master\expense_tracker\expense_tracker\doctype\expense_record\expense_record.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
33d30e1d5f12cd1181d1563f43d4d721

SHA1
d0d45a5907e552a4d439c3cd87fb4a7dc1e0916f

SHA256
f2544126696c42941b36f059b39fc8e728295a635c18fb0824cfb3340a05acef

SHA512
873eb561b40412e013eb3c3fd8fc3aa0bde3a739d9efc5a7d56d0ec490e2aef53489260f0e8b6e280133f99c943b797c91d321c66705ae204355e07405bcfd9f

Download Submit