e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
150s
max time network
44s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0007-misc-functions.rpyc
Size

1KB
MD5

6c45b042d306dcb71e1221d8d47749e3
SHA1

68be3e0fa69b79834751279dc9b4a4bf8312e289
SHA256

09fc7fb3d31464395a5b714b5422f0234f2d566d07df1f90f1888816844de5b6
SHA512

77355d5b5c92186c969eb4eab6e4785e0bda2b42e74384646d05c105a3fd4497b51f8bf4fbcd2139c93c6af57a4879fe76afc3429e390cd0a89e0521bfdb6e83

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\.rpyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2813141852-3076131560-4232376420-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2072	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2072	AcroRd32.exe
2072	AcroRd32.exe
2072	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 3048	1744	cmd.exe	30
PID 1744 wrote to memory of 3048	1744	cmd.exe	30
PID 1744 wrote to memory of 3048	1744	cmd.exe	30
PID 3048 wrote to memory of 2072	3048	rundll32.exe	31
PID 3048 wrote to memory of 2072	3048	rundll32.exe	31
PID 3048 wrote to memory of 2072	3048	rundll32.exe	31
PID 3048 wrote to memory of 2072	3048	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0007-misc-functions.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0007-misc-functions.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0007-misc-functions.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ae3d4cea57d0eb0584105691b06943ea

SHA1
dae280d38477f9c2e22e5c4174b0842e23df4172

SHA256
43577b0ad6d7bcd95e4b783c34f205108b119edce9258658cf3a70fc792f49bb

SHA512
f0fff611d80e841f369ed041e0fb5b61d2199c4e8de6616302780253b5853bc87a7e16138657aad843a78027139fa667bbaf3ba667e9facbff35032bb8b7ea1a

Download Submit