e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
151s
max time network
47s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11-07-2023 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0003-quest_data.rpyc
Size

7KB
MD5

ebb49272fd827874cf37673f9c704a12
SHA1

79bbcceeed147056e7493ae63e8b615bfa5e7463
SHA256

2dee58bfa7050354c887af3e86a40275332427b3a1b238b19244f9b8d896c7d5
SHA512

724b01a52361b90e04d48bb7e49ed0fecb5d6c0b97b89b12e16a09f92bfa0725a6ea32a0f2cf8b442161d44a6b03c58ac803e2f9a69a9f86105c9186f290d5a7
SSDEEP

96:F0C/PwnycKBjDhauizDW2aLr6H0AyC/PwnycKBjDhauizDW2aLr6H0Ay:oyvxizDWdr6UAIyvxizDWdr6UAy

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.rpyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1724861073-2584418204-2594431177-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
620	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
620	AcroRd32.exe
620	AcroRd32.exe
620	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2236	2284	cmd.exe	30
PID 2284 wrote to memory of 2236	2284	cmd.exe	30
PID 2284 wrote to memory of 2236	2284	cmd.exe	30
PID 2236 wrote to memory of 620	2236	rundll32.exe	31
PID 2236 wrote to memory of 620	2236	rundll32.exe	31
PID 2236 wrote to memory of 620	2236	rundll32.exe	31
PID 2236 wrote to memory of 620	2236	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0003-quest_data.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0003-quest_data.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0003-quest_data.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:620

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a96f77d27895636dad8261b6e7b61d04

SHA1
9569feb0a1ecf9b37f735428ac92649c89322a14

SHA256
385b1c7ae11508d9802e08e256fb251eaa0a103b80c7e75af9890ab2bcbb0e22

SHA512
754eaa2731b53e90e2f58a024e659209b19d12b25d5125b6a6a62a62292cb0dcbf5a6e12ffee4045022b69d4679a84dfe51764033da5c740337dcec801ab6780

Download Submit