59e4fac681f8e2e2db47821e1d1e1d76713363dadd006ee060d396b363c43e27

Analysis

max time kernel
122s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 14:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

windows/loaders/bfltldr.py
Size

7KB
MD5

c03afd43bd40b6c7d815f04cae20fe1d
SHA1

5613b4e98965a02816e58f3e8f463f6aa1ee08c8
SHA256

7c53dedf35cb5377ca0bf66827cf771bd333eac7665c8ba356bfad2431fd108e
SHA512

d2079e4b290abe4785058d7dfb16710abe9c4b17b818aee479781dcf7120d0f3c8aedb68d1f528dda6cb0e2470819784de549e3c8a364715be7493192acd7e02
SSDEEP

96:NTmWPklDXfN0UNyqvmUZyOnIMnm2l35MbJrayWPcfmV+0GSJJ:LPklPKG1vZvLl3ybJ7zmV+0rJJ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2560	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2560	AcroRd32.exe
2560	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2824 wrote to memory of 2924	2824	cmd.exe	31
PID 2824 wrote to memory of 2924	2824	cmd.exe	31
PID 2824 wrote to memory of 2924	2824	cmd.exe	31
PID 2924 wrote to memory of 2560	2924	rundll32.exe	32
PID 2924 wrote to memory of 2560	2924	rundll32.exe	32
PID 2924 wrote to memory of 2560	2924	rundll32.exe	32
PID 2924 wrote to memory of 2560	2924	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\windows\loaders\bfltldr.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2824
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\windows\loaders\bfltldr.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\windows\loaders\bfltldr.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
cb7a858cc98cd4c2e60554d92d11e1e1

SHA1
5faa713ad729d44d5c6468d08447ba96e038809d

SHA256
e095b36d2ebb641a971c52db967c62da4072eb57433ca12c84bc21bb5810b932

SHA512
605c4ef8fa16e506b4c0a8104eed0dc89cfb30f49c5604f781bbab2fee4748dd43eff32d4734d828998757e9f9656c333a6ba7761d3f1914a1996dc8b2068c81

Download Submit