r77

General

Target

https://dl.dropbox.com/scl/fi/md35kza3ovtldr028n8qj/Windows-7b.7z?rlkey=veni7s30cnwxlug54qi7ki4om&dl=0
Sample

240202-p6ra1aeeh6

Score

10^/10

Malware Config

Targets

- Target
  
  https://dl.dropbox.com/scl/fi/md35kza3ovtldr028n8qj/Windows-7b.7z?rlkey=veni7s30cnwxlug54qi7ki4om&dl=0
Score

10^/10

r77 adware discovery persistence rootkit stealer upx
- Suspicious use of NtCreateUserProcessOtherParentProcess
- r77
  r77 is an open-source, userland rootkit.
  rootkit r77
- r77 rootkit payload
  Detects the payload of the r77 rootkit.
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request
- Creates new service(s)
  persistence
- Modifies Installed Components in the registry
  persistence
- Sets file execution options in registry
  persistence
- Allows Network login with blank passwords
  Allows local user accounts with blank passwords to access device from the network.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Registers COM server for autorun
  persistence
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1