8ae976c8b28baa222b4fd527cccbad2d1102ed21c68f9082c53835fde94c2397

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 13:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

email/mime/text.py
Size

1KB
MD5

f06fa84520d40c313ea6368932c0c3dc
SHA1

2239e83db6d3919eaa0c1316bfd92b232d7cf9e6
SHA256

aa903b8248020e9211e88f2c3a5e3a05f6969b6aab2b6f01ea1ddff776b870de
SHA512

4bd477355fc527cd508d7aca6f9729a34bce43f9ce9adaf8200fbd4c2ff0ecb8ffc8e9b232102e673e8fb13ff34dbc6340642ca5fa8615ff250d0e35b8b3eb8e

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2620	AcroRd32.exe
2620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2956	2808	cmd.exe	31
PID 2808 wrote to memory of 2956	2808	cmd.exe	31
PID 2808 wrote to memory of 2956	2808	cmd.exe	31
PID 2956 wrote to memory of 2620	2956	rundll32.exe	32
PID 2956 wrote to memory of 2620	2956	rundll32.exe	32
PID 2956 wrote to memory of 2620	2956	rundll32.exe	32
PID 2956 wrote to memory of 2620	2956	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\email\mime\text.py
1⤵
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\email\mime\text.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\email\mime\text.py"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
219ec727c3859aea0dad26370752dcc9

SHA1
7eede1891653d817ef70c2bd526de2f54e74dd50

SHA256
164c656d50fd0824064f55844707c8698beeccdede742ce09788d0e642cd7bf3

SHA512
1d85bbfeab08f30e1c571cd996673e1d8b7f199098a7b0466227c0af55d74854390a6251dfa206076f1d1526c9921061161814c66a26839953f422ba65b1f44c

Download Submit