Analysis
-
max time kernel
101s -
max time network
212s -
platform
windows11-21h2_x64 -
resource
win11-20250313-en -
resource tags
arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system -
submitted
30/03/2025, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
rickroll.py
Resource
win11-20250313-en
windows11-21h2-x64
9 signatures
300 seconds
General
-
Target
rickroll.py
-
Size
7KB
-
MD5
45bfb274bdd96508e4ad4dcb28a673a0
-
SHA1
4948ae6843b8c9ef6cee939862f0cfaa00364e17
-
SHA256
582b4999bbcad82979496e78dac6530e8ce3ec02b9429a80198eb5aeca7f73ac
-
SHA512
726cb5b85f10b8a245a2eb4289c1dc963203910ae29323fb9cc071fb16a291a4bf9e61177905f020b5ccf785ebf510bcf25494ba9861a33092ef9999a023e8a0
-
SSDEEP
192:629cRlrDDqbbKXNClrDDqTLRVEsNS1ocdOMSAl4/iEUNS1Lz:6xryvnryTLRVEsNSJQKIiEUNSF
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AcroRd32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RdrCEF.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\.py\ = "py_auto_file" OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\曲⪥ɔ蠀죰Ŕ\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\曳⪤̧谀痀 OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\py_auto_file\shell\Read OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\.py OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\py_auto_file OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\曲⪥ɔ蠀죰Ŕ OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\曳⪤̧谀痀\ = "py_auto_file" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\py_auto_file\shell OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\py_auto_file\shell\Read\command OpenWith.exe Set value (str) \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" OpenWith.exe Key created \REGISTRY\USER\S-1-5-21-1736937623-2710279395-1526620350-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 584 OpenWith.exe -
Suspicious use of SetWindowsHookEx 39 IoCs
pid Process 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 584 OpenWith.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe 3224 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 584 wrote to memory of 3224 584 OpenWith.exe 84 PID 584 wrote to memory of 3224 584 OpenWith.exe 84 PID 584 wrote to memory of 3224 584 OpenWith.exe 84 PID 3224 wrote to memory of 2212 3224 AcroRd32.exe 88 PID 3224 wrote to memory of 2212 3224 AcroRd32.exe 88 PID 3224 wrote to memory of 2212 3224 AcroRd32.exe 88 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 2040 2212 RdrCEF.exe 89 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90 PID 2212 wrote to memory of 1568 2212 RdrCEF.exe 90
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\rickroll.py1⤵
- Modifies registry class
PID:4760
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rickroll.py"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3224 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=30A6C0BF1F56D6AA75C1E22C69B8108D --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:2040
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0B3CB8603C9BE5AF5A873861F206FFCF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0B3CB8603C9BE5AF5A873861F206FFCF --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
PID:1568
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5758EEBC5ADCCBF1082FEB5146907605 --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0943500FD181954D80CAA31EA273E52B --mojo-platform-channel-handle=1984 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6DE39145D1AE4B598DE391FD60E77194 --mojo-platform-channel-handle=2352 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
PID:3308
-
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3292