041f5db0a0c289c686db8adf4a72fc70ff2ab19339f7f10b3304dee8d327e47b

Analysis

max time kernel
18s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/02/2025, 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

main.pyc
Size

1KB
MD5

2c39c6452298d0724185d2df509115f3
SHA1

ca56fa4bc84ff0b78479ca0e046d76041cf74730
SHA256

8ae3e67a0ef604922d3e05b7bd9d0072c7585de48dce207885a6516bdeeb9811
SHA512

6e9a58853b179ec378c2f2da41b156505ebbdf2e129a7a8d21262f18d8abc1fd09f40fee4d3e09fa8e504e61a85545e28fb436fabd86093983a2b1aabc4148ed

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2980	AcroRd32.exe
2980	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2300	596	cmd.exe	31
PID 596 wrote to memory of 2300	596	cmd.exe	31
PID 596 wrote to memory of 2300	596	cmd.exe	31
PID 2300 wrote to memory of 2980	2300	rundll32.exe	33
PID 2300 wrote to memory of 2980	2300	rundll32.exe	33
PID 2300 wrote to memory of 2980	2300	rundll32.exe	33
PID 2300 wrote to memory of 2980	2300	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\main.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:596
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\main.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\main.pyc"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
63ad2c4e7520fd0dcc120ceb6b0f5fd5

SHA1
650a34666d1afcc1c63983358411c0f8207e691c

SHA256
144b3cf2a3c67697e46477a730adfe220caffaa744f87d8d55e23c24d14acb5c

SHA512
eeb398d6679fa7f3bad7ec4e691b014e0573e13e97cb537308b189df1214f97552b5ed099f374c542310f0012d7c13de55e3bb2eebfb5b393cf049775aebca98

Download Submit