39c4afc796f6730ec8da841d1aec05f2c3e87424952f6e85049a98f66edea31c

Resubmissions

18-01-2025 20:09

250118-yxfycaspdz 10

18-01-2025 10:10

250118-l7g7ya1mcn 10

30-12-2024 21:29

241230-1bxp3szkaq 10

01-12-2024 13:51

241201-q58dkasqaz 10

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 10:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

c26ca850b8027b5e4e28a7000145afba
SHA1

1c3dca23fb11230d0f7dae9bd3d5a4852f409d06
SHA256

9d2e1266a391fe12a9790d3d2a9f7835ed06f7f50323199c8e3cb19a6f5c8969
SHA512

00a8ee251199d238fba3ac529b0e1c53ec6e63e135a01d1181b312efd3cd69492c5f6acd69ef89cb6abc621e7eae3f86324f06772a535aa096af7f09f410e45c
SSDEEP

192:wzcA2D848O1WdXwJ1G33Fi5JhwDk/MdwIxnw:jsyWuJ5z2cPIxw

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 1528	2780	cmd.exe	31
PID 2780 wrote to memory of 1528	2780	cmd.exe	31
PID 2780 wrote to memory of 1528	2780	cmd.exe	31
PID 1528 wrote to memory of 2580	1528	rundll32.exe	32
PID 1528 wrote to memory of 2580	1528	rundll32.exe	32
PID 1528 wrote to memory of 2580	1528	rundll32.exe	32
PID 1528 wrote to memory of 2580	1528	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
847448736d1749f06dd08a1aa827e66f

SHA1
f285826ad7e3fcf46b4007717db4805dd2a19403

SHA256
4de682df17967ca8e38313d02d44e8864b8f447caa3beed69db7cf1d5970c011

SHA512
f0c2b3363947a1b7f1a756cf6de00c9a04f3b973cbcf5f2d44bc617ea24e437471f148083946644bd2409868eef5586a5e3151ee8e0b210052e280c16bfb0b07

Download Submit