2c3a2b9bf44cabeac520d4b22e37e0e7059f325b0c2cabc23242fe6559bf0e96

Analysis

max time kernel
3s
max time network
130s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/yaml/dumper.pyc
Size

1KB
MD5

bb0ce14f3b5f9aee043ee3b4e8418cb6
SHA1

15491a1109d13320171be7e22ff7af8c2b7681f5
SHA256

f6ff638fef0a37a2f5bbbf9b4326c775335c97c08344c3f759b142a8bf1a0663
SHA512

13500f186b61055bf3d9478a34752f6ef452926026fe916158849127264ce44ba31b7a5ce59b6b65273d57f2df9cc19c59c0bc4dd005fc90b487fb08992288a4

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2320 wrote to memory of 2700	2320	cmd.exe	rundll32.exe
PID 2320 wrote to memory of 2700	2320	cmd.exe	rundll32.exe
PID 2320 wrote to memory of 2700	2320	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\yaml\dumper.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lib\yaml\dumper.pyc
2⤵
PID:2700

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lib\yaml\dumper.pyc"
3⤵
PID:1988

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
e969d023624343c8901c47776b1e1d7a

SHA1
78244e94c854043da9ce9c7bff83165b9ce005e7

SHA256
b64961219ec981517721a54fff4da263279fe791fdf323b976a6eec63033f129

SHA512
ce95b2ff999cc095cc81e0920cea9fa232d8da4cfbe75ab2dbff5743c112bd8975ce0d12d442d9eb1337d0e9591ef453c5d99ab1b6c572c1cc9c74e66188833f

Download Submit