e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
157s
max time network
55s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0005-battleclass-power.rpyc
Size

1KB
MD5

81de0fa4248a92cf4ca07f80544357fa
SHA1

d534b63dfa7ef4ef14d09cc481d4d5096ad99cba
SHA256

1b28a4fa14d2e72b2aba6ee1cf4c9af304755984f0dd7dfcaa267e678300a0c8
SHA512

55cf5ba07cfe63d5dc7d2be00cd652a71cd4b084e5e994f6921bafe03e8de292fd01dc17705d3e4dc173104748c3484fd7cfd795985eee1b6752375e7a382daf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2240	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2240	AcroRd32.exe
2240	AcroRd32.exe
2240	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 2844	2936	cmd.exe	29
PID 2936 wrote to memory of 2844	2936	cmd.exe	29
PID 2936 wrote to memory of 2844	2936	cmd.exe	29
PID 2844 wrote to memory of 2240	2844	rundll32.exe	30
PID 2844 wrote to memory of 2240	2844	rundll32.exe	30
PID 2844 wrote to memory of 2240	2844	rundll32.exe	30
PID 2844 wrote to memory of 2240	2844	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0005-battleclass-power.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0005-battleclass-power.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0005-battleclass-power.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2240

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
315b994a04d13955fd4d1efea910549a

SHA1
c4c8dd5d830b49377ec19cab1e35ef07b70ba460

SHA256
868a81d112da5d23dff07b1f50e8b00e04bf02802a0d84c27cfb84805ff6a7a5

SHA512
a5f25598aecf87091b64bcb4d75bdbc287e55cf78aee26e49d81eba16e5d2efcfeb3a902cffbb7f2e83d03257158c489cc6ae0ecf76768cbee9a06bcdf3119b4

Download Submit