2c3a2b9bf44cabeac520d4b22e37e0e7059f325b0c2cabc23242fe6559bf0e96

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/yaml/__init__.pyc
Size

11KB
MD5

fd6ef2e2d3eb7b7c25d27d702772c2bd
SHA1

6f45875532d4ba6357940761e53d9621c9bbd30b
SHA256

44c71850563f85ea56d777863aa312a3943b656c651b7bf0c70fe2010e7130a9
SHA512

61f6bcf16ed6ca536fc14d408ea01dc87be1c10f7bcf0d17b64af8a2fa6f2895c0ae2f92429ee583f9b02a5c33f636518e0f446257a64463eebaa6029ffbab7a
SSDEEP

192:vvcqmnENv0qqzq9qcDqnKqgEqSqhqvqHqwqKCw4nZKE8Wzn4Q5o9sq6q1qCXI1jx:3cqmENv0qqzq9qcDqnKq1qSqhqvqHqw0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.pyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\pyc_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2936 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2936 AcroRd32.exe
2936 AcroRd32.exe

pid	process
2936	AcroRd32.exe

pid	process
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2392 wrote to memory of 2452	2392	cmd.exe	rundll32.exe
PID 2392 wrote to memory of 2452	2392	cmd.exe	rundll32.exe
PID 2392 wrote to memory of 2452	2392	cmd.exe	rundll32.exe
PID 2452 wrote to memory of 2936	2452	rundll32.exe	AcroRd32.exe
PID 2452 wrote to memory of 2936	2452	rundll32.exe	AcroRd32.exe
PID 2452 wrote to memory of 2936	2452	rundll32.exe	AcroRd32.exe
PID 2452 wrote to memory of 2936	2452	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\yaml\__init__.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2392

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lib\yaml\__init__.pyc
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2452

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lib\yaml\__init__.pyc"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2936

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
5ec1b31e24aaca292ba3d2a233820048

SHA1
4f877f2b3002492f57c5d5b94eed477ca8928035

SHA256
85c5f1347e41039a75e97bce54c3978d86fd3e6a16f6e1e44535e3d1a0c7d2c8

SHA512
50c2c45151145f8eb39c238836016509a99a0b2ed12998b09b58d86da8666c7d56a5f92ff6bfd653756b252122cb682e48608c0f0e92de3c115091b434909cbf

Download Submit