e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
150s
max time network
45s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0003-battleclass-sustainedeffect.rpyc
Size

1KB
MD5

7ee3dcb58a1852466be5ec3dfc8fda95
SHA1

c4d3a743b60fd058d6bd2bef00e4375bd25bd51e
SHA256

60405aa89cad2fc59c4400060507de10b149d16a401b260a6c0b2184b1746eb6
SHA512

e2aaf21a34ffdaede1f270a994973556f7c7fbd2275badc131868f5578993b94ccfec721cf2aa81de65a937bcac1dfd3e35dd32a3e4885fba5969b621c751a93

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\.rpyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-264077997-199365141-898621884-1000_CLASSES\rpyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2976	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2976	AcroRd32.exe
2976	AcroRd32.exe
2976	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2244	2348	cmd.exe	30
PID 2348 wrote to memory of 2244	2348	cmd.exe	30
PID 2348 wrote to memory of 2244	2348	cmd.exe	30
PID 2244 wrote to memory of 2976	2244	rundll32.exe	31
PID 2244 wrote to memory of 2976	2244	rundll32.exe	31
PID 2244 wrote to memory of 2976	2244	rundll32.exe	31
PID 2244 wrote to memory of 2976	2244	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0003-battleclass-sustainedeffect.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0003-battleclass-sustainedeffect.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0003-battleclass-sustainedeffect.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
130bd8d73115bbbe3350fd5aacb99dda

SHA1
655e16695c763c27c2d32c7dfa189a22ba46c91e

SHA256
8c96553d0d1ac54c2c153f883ffc6d0459376c7e2f4605001742292b89e07e21

SHA512
c16fdca33c7a8bc9f3583f68085024ec9cd7c12e57758210381a796ba8182dd44bc09fbb9946731a36889c3db804605a27f370b85e6d24b76062f79139275ceb

Download Submit