e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
150s
max time network
77s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0000-battleclass-combatant.rpyc
Size

5KB
MD5

b575a5dc5022449e5cd4beda6ff5aede
SHA1

3b66316a4c609002f680e19223fd9fc8721b86ab
SHA256

ad219fbc66f53590af256b38966d622417399ceb801ae933716b1ef6aa39d623
SHA512

82cb6b288c48068848e133c81dd60756615505343e97d02a822af741ed48c3c261ab9e75842daf7eb9813e71c7bfa799ce0f4cbd1a38c962386f004be661297b
SSDEEP

96:Fu05WpUeHnfKquf6hkgJ+Ro96KC228f3lHFeBQnPhK05WpUeHnfKquf6hkgJ+Roa:UKMKpf6NZgKCR8/pFeBbKMKpf6NZgKCr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.rpyc	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3891603265-141683679-4067940827-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2224	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2224	AcroRd32.exe
2224	AcroRd32.exe
2224	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 992	2420	cmd.exe	29
PID 2420 wrote to memory of 992	2420	cmd.exe	29
PID 2420 wrote to memory of 992	2420	cmd.exe	29
PID 992 wrote to memory of 2224	992	rundll32.exe	30
PID 992 wrote to memory of 2224	992	rundll32.exe	30
PID 992 wrote to memory of 2224	992	rundll32.exe	30
PID 992 wrote to memory of 2224	992	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0000-battleclass-combatant.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0000-battleclass-combatant.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0000-battleclass-combatant.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2224

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e45bba09fc3751bc95f87149556ec266

SHA1
db71ecb577d8417baa9ab8b9de9e205b3462bcd2

SHA256
434a7fbbbb6a368bf5448690661bf2454748dad2a335298f3b45268d94b9a045

SHA512
0a2cfdd69502af40ee4f04723d5c02a6795c175ff634094dad7b87ade1fd32e30e17ddaf3239d70ec0b55054e4d4c82da7b73d4086b99da557c6790c290c57e3

Download Submit