10bcf998d8b57e71eafc5d946eedf7a359c8a7fead89efc3ffc54d491d7d7728

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

source_prepared.pyc
Size

172KB
MD5

612a5a9c85652a86e0bd4f02d2af38c2
SHA1

be58812b4fad5ac630677a350cd288ab846cda98
SHA256

e47f45d74910a12f307eb75a8c30d963c3fb1345639dd9fe4a5109cef193a3ee
SHA512

ad4880ea2562b8781d25c7b573a47807bff6af12b0d98ebd1e49cb51eb6382bb0f64f732b3fc01dfd05371f4af5bdf50a76d8e7fcc15249c86c3f37ee11deaab
SSDEEP

3072:yRzHTC0aOO64G1hbTFovPZTerUScdQQV+mwiIvdXzpxsTxw:yRHC0aOO64GTFo0j8SmMse

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2156	AcroRd32.exe
2156	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2668	1668	cmd.exe	32
PID 1668 wrote to memory of 2668	1668	cmd.exe	32
PID 1668 wrote to memory of 2668	1668	cmd.exe	32
PID 2668 wrote to memory of 2156	2668	rundll32.exe	33
PID 2668 wrote to memory of 2156	2668	rundll32.exe	33
PID 2668 wrote to memory of 2156	2668	rundll32.exe	33
PID 2668 wrote to memory of 2156	2668	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\source_prepared.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b10dec627ca1e8a568872dc9980148f7

SHA1
6b6d2e35ef0448a87ef7be7fbb70391d4f462c9a

SHA256
4dffee0efa17aa7931985ce6b2ee811e7c3508fb1f0dc781715646fd456de7f0

SHA512
e74fc0a17a9f19835bbcbf7c2c334833243357e82ccde000ee3a474924692c5a9d3d93f0e8cca9a70b5caa7812fd21383239bf4e7abe11016b2b037c61585c0e

Download Submit