c112b2f07061632926d7d8f68614de49148fb529a668dc11909edde99bbc543d

Analysis

max time kernel
119s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-02-2025 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mhlib.py
Size

32KB
MD5

40ceb42b8e6b2fa75af5167cb096afc0
SHA1

064ab1c4a77672aa66ebf2d91af0b55936c27805
SHA256

98f0fa0847f3b8fa270925d1a556099a83b8d4ec53f09738c9475f169cf30ecb
SHA512

c0e67d365886dc6fe57cc77eacda58572e85407bd5d3793144e9d2c15e343cbc22e03774706231475ca71b01dc4e8e602736057430f2f128f1ff41144f380009
SSDEEP

384:XFlhbkz8+UH8velIkHlq7cjeh89o02iBDw/Jwfw:e68vQIkHRjC8qkDWJ5

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1932	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1932	AcroRd32.exe
1932	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2860	1292	cmd.exe	31
PID 1292 wrote to memory of 2860	1292	cmd.exe	31
PID 1292 wrote to memory of 2860	1292	cmd.exe	31
PID 2860 wrote to memory of 1932	2860	rundll32.exe	33
PID 2860 wrote to memory of 1932	2860	rundll32.exe	33
PID 2860 wrote to memory of 1932	2860	rundll32.exe	33
PID 2860 wrote to memory of 1932	2860	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\mhlib.py
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\mhlib.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\mhlib.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
b524f0a0cda738dc8c4a4686f5e11a5f

SHA1
fab3ab46e7b4b21763f94c7165db7cbd0f6b6c47

SHA256
b62dad1e5b0718d6c529b3c36027083d11e88146bc8ec05780a9761c34e34834

SHA512
ad5fd503edb51ee45d503d44cffd30bc581bf778fcc3c5ea18e9dac061c7cb04d88b0d827f0d37ea57c87d37442bd48b4ecce9b53980acf3435ecc59da1400c5

Download Submit