2c3a2b9bf44cabeac520d4b22e37e0e7059f325b0c2cabc23242fe6559bf0e96

Analysis

max time kernel
2s
max time network
138s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30-06-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

lib/xml/sax/_exceptions.pyc
Size

5KB
MD5

c7f37e0869c6e1f8057e7e769e1321f6
SHA1

aa0d91723c1e806b3d34970eb89c982087698377
SHA256

b9d145efecd3e993de9efb834161d63fb50a24a32e40c2aa6ba46ee3a71236af
SHA512

f29e7b9707f52d6b05fda5a3ab08df9c30249a6ecc92d02d6654338eee1e02d66ad9b2b7f0c173d7f10aee4de2faa497af02e42cf9eede3f5f011ef9422a4fdb
SSDEEP

96:hMTtAOeC1FQig+6c+IpJ69EVSJtAWRtToJWo8nzSrmymdL/97p/7Lry:hQOtUFQ1yPVenU6zjzdBt/7Lry

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

cmd.exe

description	pid	process	target process
PID 2996 wrote to memory of 2792	2996	cmd.exe	rundll32.exe
PID 2996 wrote to memory of 2792	2996	cmd.exe	rundll32.exe
PID 2996 wrote to memory of 2792	2996	cmd.exe	rundll32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\lib\xml\sax\_exceptions.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\lib\xml\sax\_exceptions.pyc
2⤵
PID:2792

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\lib\xml\sax\_exceptions.pyc"
3⤵
PID:2152

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
1037aa303ab9f9e55e1b1c1d04bdbe4b

SHA1
d474ee853e0392628f5ed2c0a4576958e1dc7e94

SHA256
6f1227ab86f458e30e3ce9ef1b0d06bf6d2956829a7dee7e8344c90c59efc1c5

SHA512
6b49551b4334d854c217eb155a2a37f1c4714434375c92fea0852ec02ae5ef44d5cf0562b65385ca127cb34e92967f92cb9174c9115698cdc5c1e9f8f8b01d1a

Download Submit