dddd2be8f4d72ca2c070cc70cb07c8ef7a4f85f23e40eac46d44f8b7e4afe127

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
07-02-2025 08:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Shohei's Adult Streaming Channel/lib/windows-i686/Lib/warnings.pyo
Size

11KB
MD5

52c5608eadc15e2bc9939bcea787647a
SHA1

d3d9a10514086632d0df6d8686ae1a41aa4c3acb
SHA256

37b7cd1b00ed0759d64a8299b863a447b0f1171323026b5f499afd9514c51ded
SHA512

9408797f5900922c66265adc7681e00ebc0a54b8982ef6ffd01cad9552929f5553af4affdced33a7bdfa016a405ffc689346bab0a423e12163e111b0a4afc148
SSDEEP

192:Ht1Y6PCfXSgsEbCz6pmiDAHQrI+WaLQawVHRPMP0aLtcprv3c+ay2a:3jNsmz6pmiwQrvQaoSfLKVv3cg

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2852	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2852	AcroRd32.exe
2852	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2848	2256	cmd.exe	31
PID 2256 wrote to memory of 2848	2256	cmd.exe	31
PID 2256 wrote to memory of 2848	2256	cmd.exe	31
PID 2848 wrote to memory of 2852	2848	rundll32.exe	32
PID 2848 wrote to memory of 2852	2848	rundll32.exe	32
PID 2848 wrote to memory of 2852	2848	rundll32.exe	32
PID 2848 wrote to memory of 2852	2848	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Shohei's Adult Streaming Channel\lib\windows-i686\Lib\warnings.pyo"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Shohei's Adult Streaming Channel\lib\windows-i686\Lib\warnings.pyo
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Shohei's Adult Streaming Channel\lib\windows-i686\Lib\warnings.pyo"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
118f21d71a5db9cde1f2eab3c0ee0b93

SHA1
541c65aa99e8b7916de25c5da1d41dc5144a67fb

SHA256
01d2481c9939f973fc064add555d73c889a6e9bda4e40f0fa3533bc2a1f74824

SHA512
a84256578dd4754510094c3c820fffe6e02181ea7e7490ce175f873e6d020dae68d75e0964e16961b9fb58c0759c588722e9067256186e51d03f6e6fd0f3c9f6

Download Submit