81788d573b843f11600689a7b206d91bde7f9664dfe8574b2d3d1281932a018c

General

Target

main.pyc
Size

7KB
MD5

bc895dc943674837f661c48c8947c838
SHA1

c38f27b8b01da2dc2772107d45f9b029e29f5787
SHA256

2da1bfe62e27dee51dc0dea6306ccc301e5cf6be892bbc8b27004292a6051ace
SHA512

16ea705eeb693bcac573bedf4db4cbc881503e790be62a9d218f0798bc0e2ce85b0d75a2c2dded7449369b69ad1da601c4d988ed7655b75c06c55a85eff53512
SSDEEP

192:wge4BdTsdD8WY6rNWdXweIiRFvsGPTQJhw0QEMdw8S9nw:Beadok6pWue6Kg20tPrw

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\pyc_auto_file\shell\edit\command	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2360	NOTEPAD.EXE

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2208	rundll32.exe
2812	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2640	7zG.exe
Token: 35	2640	7zG.exe
Token: SeSecurityPrivilege	2640	7zG.exe
Token: SeSecurityPrivilege	2640	7zG.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	7zG.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2684	2644	cmd.exe	31
PID 2644 wrote to memory of 2684	2644	cmd.exe	31
PID 2644 wrote to memory of 2684	2644	cmd.exe	31
PID 2684 wrote to memory of 2812	2684	rundll32.exe	32
PID 2684 wrote to memory of 2812	2684	rundll32.exe	32
PID 2684 wrote to memory of 2812	2684	rundll32.exe	32
PID 2684 wrote to memory of 2812	2684	rundll32.exe	32
PID 2208 wrote to memory of 2360	2208	rundll32.exe	38
PID 2208 wrote to memory of 2360	2208	rundll32.exe	38
PID 2208 wrote to memory of 2360	2208	rundll32.exe	38

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2972

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\main\" -spe -an -ai#7zMap17371:88:7zEvent19824
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2640

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c20763dd0925f730a94b62a30d6051cc

SHA1
03e93eec4a7c8f94f8a2bdb422e803ca601fbe0d

SHA256
aaeed3b2f8a54bd404aaa9efea78e6a54f9d7272cb6d261ad7ca101a9c152bc5

SHA512
d10a332f4077f004cb68e26f388e01388f07150a026fd909fafe5c2ee34228c82b019cdcdd549c856185332b2ea3385d27191faae6590d97c8f782a6aa81298c

Download Submit

Analysis

Sharing