e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
150s
max time network
47s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0001-quest_class.rpyc
Size

2KB
MD5

9b855b0fa439ab6dc97968e58168cb7e
SHA1

df6b5dfd33074b0972d7be781f88aa2f062e30e3
SHA256

aa8934d17288790ba8fae1de0145680bf69a1a2feab2e265c94fe9849d0f65ac
SHA512

91c3ec8775c0c43d63cbc3848efabe600b4dc536913041a3cce2d8582d8e82fde85195061de96787fdbc0489860d00751d53f9004ff1f766b1852c3077afe80b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.rpyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1692	1988	cmd.exe	30
PID 1988 wrote to memory of 1692	1988	cmd.exe	30
PID 1988 wrote to memory of 1692	1988	cmd.exe	30
PID 1692 wrote to memory of 2892	1692	rundll32.exe	31
PID 1692 wrote to memory of 2892	1692	rundll32.exe	31
PID 1692 wrote to memory of 2892	1692	rundll32.exe	31
PID 1692 wrote to memory of 2892	1692	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0001-quest_class.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0001-quest_class.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0001-quest_class.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
10cc0856a358da0f65881258244af3ab

SHA1
7e7e5efdf347d61a88f1effdfb804c2741a91504

SHA256
3d8c4f9f22fe294a9844bc0a7173157c39f857a487a77db719796bb102c48a6e

SHA512
8d1b8f333c23eb0e0e0bfa3b34ac8ecd1f9030149f79b44cc9606a0573f9e8f53dfba45cc54198d544151a4f7c6fc3234881804fdc2b6f627f4e079efa8a7ddc

Download Submit