e7c9e8ba3c0dc98fc22b5564c29ad8cd9fe2e08c05b37c860de6e798fc781d6e

Analysis

max time kernel
156s
max time network
51s
platform
windows7_x64
resource
win7-20230703-en
resource tags

arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
submitted
11/07/2023, 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

x-0001-battleclass-player.rpyc
Size

1KB
MD5

360394871040ca5760dbd0d903001c81
SHA1

9fbfbf7cd435d1640121a1c987376fcf9bc6e0fa
SHA256

dd91d5cca38645f9876701803f4a2bf22236d8641dd267b79110372993245014
SHA512

dc2cd4783cc76e347cd1771770314ef0379254df566741cebf58af58e7d2792dce830be9271ce96b256d57c2085e55ab4ccc65b9dc7417c41db2b5b1fd86a318

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\.rpyc\ = "rpyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2859459355-424593036-1984306042-1000_CLASSES\rpyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1672	AcroRd32.exe
1672	AcroRd32.exe
1672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 2116	3064	cmd.exe	29
PID 3064 wrote to memory of 2116	3064	cmd.exe	29
PID 3064 wrote to memory of 2116	3064	cmd.exe	29
PID 2116 wrote to memory of 1672	2116	rundll32.exe	30
PID 2116 wrote to memory of 1672	2116	rundll32.exe	30
PID 2116 wrote to memory of 1672	2116	rundll32.exe	30
PID 2116 wrote to memory of 1672	2116	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\x-0001-battleclass-player.rpyc
1⤵
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\x-0001-battleclass-player.rpyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\x-0001-battleclass-player.rpyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
626f399d39bd4972ecdcbfb06a3cd1c9

SHA1
414742fe8fb8cc8b2065c86161b6d933c791eab8

SHA256
a0b7df332e270a6870befe4d181ded9d5e9a62497512ba789ebf6f84d6307a65

SHA512
f0e7f0602a88a8e629e1a9893fddf45cab5f0390eb456a520887b00c1db94a4ab40bf79bcb23c578d60bf170854b4340bfd07cfb0997e3511454532e8dd89a9c

Download Submit