39c4afc796f6730ec8da841d1aec05f2c3e87424952f6e85049a98f66edea31c

Resubmissions

18-01-2025 20:09

250118-yxfycaspdz 10

18-01-2025 10:10

250118-l7g7ya1mcn 10

30-12-2024 21:29

241230-1bxp3szkaq 10

01-12-2024 13:51

241201-q58dkasqaz 10

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-01-2025 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

7KB
MD5

c26ca850b8027b5e4e28a7000145afba
SHA1

1c3dca23fb11230d0f7dae9bd3d5a4852f409d06
SHA256

9d2e1266a391fe12a9790d3d2a9f7835ed06f7f50323199c8e3cb19a6f5c8969
SHA512

00a8ee251199d238fba3ac529b0e1c53ec6e63e135a01d1181b312efd3cd69492c5f6acd69ef89cb6abc621e7eae3f86324f06772a535aa096af7f09f410e45c
SSDEEP

192:wzcA2D848O1WdXwJ1G33Fi5JhwDk/MdwIxnw:jsyWuJ5z2cPIxw

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2784	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2784	AcroRd32.exe
2784	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2288	2132	cmd.exe	31
PID 2132 wrote to memory of 2288	2132	cmd.exe	31
PID 2132 wrote to memory of 2288	2132	cmd.exe	31
PID 2288 wrote to memory of 2784	2288	rundll32.exe	33
PID 2288 wrote to memory of 2784	2288	rundll32.exe	33
PID 2288 wrote to memory of 2784	2288	rundll32.exe	33
PID 2288 wrote to memory of 2784	2288	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a43797e44bf3b8ccd028c445fbc64e8a

SHA1
2eae532e4925908e5ac7ab8e017e190dd8e46420

SHA256
c7863b53dba8690e53b96765d2b079c7ad3f13e9fd00f06dd477c5458cad1cfa

SHA512
3c18a7ed48ef2e8cd199a374be0dbfa65cc6fd9365c52424e3280fa75ad1d3f08dbf57ff01999b1eb6f1201a015af4ba31f4e34f663a5e59bb830219885d2e28

Download Submit