e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
151s
max time network
59s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-000namespaces.rpyc
Size

1KB
MD5

a68c7d7ff342389cff52e5fe4959c93e
SHA1

677a34dcea632414fe9ee739e5eb8fdc2b676a62
SHA256

ca37eb7d19e5b71fe2875026f8ce3bc5bbcdc3afb2f7779578e69cc1060750fe
SHA512

840e64055e200bf6bc636143e6029193471d20f3a7a8e18391592db7e8cf2161502415c24f8fb7c357df759831b42f2e7bca1a1a627d3f8e6c88a0c8d2d5c7e8

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1296	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1296	AcroRd32.exe
1296	AcroRd32.exe
1296	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 820 wrote to memory of 1460	820	cmd.exe	29
PID 820 wrote to memory of 1460	820	cmd.exe	29
PID 820 wrote to memory of 1460	820	cmd.exe	29
PID 1460 wrote to memory of 1296	1460	rundll32.exe	30
PID 1460 wrote to memory of 1296	1460	rundll32.exe	30
PID 1460 wrote to memory of 1296	1460	rundll32.exe	30
PID 1460 wrote to memory of 1296	1460	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-000namespaces.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:820
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-000namespaces.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-000namespaces.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1296

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a78c6d1fa3aa59e5d1579f352c33cb22

SHA1
336ce3e2ab7549df5d260235992e3492d52ec3e2

SHA256
29cb803a0e312c86f5cca937d4d0737d53f13d74a60bdf3cbe08af7c8343d6ae

SHA512
1f00db52d7d0281d8233eab51eafdf95b9d469529328a7de48e0d9468d4d4e67d03fbb9fbcd24c738046e32ae7f6406712959d7ac6ea6ab92bbac246e1a8ea8b

Download Submit