ff2c2ae77e1b00829710601852b7dd95c4db15f332838807605e53bde54692df

Analysis

max time kernel
118s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-02-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

res/scripts/client/gui/pmod/views/battleInjector.pyc
Size

1KB
MD5

a508ee96d0fb4135799e2240cb877471
SHA1

ebb0b355ffd0db8082a8de9e81526e72eed9a181
SHA256

67970af6c1b53df12b26178f8e446b6e8a91b998cee825491e29420acc1b0a7d
SHA512

583bec8c836975c8e8ed083499582743690d94e100882d1c3063b583de5cd96d9813d538390b4f241f32bf5be841c645e7cab513760cb85e3a5fedb9ae3f2117

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyc	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.pyc\ = "pyc_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\pyc_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3064	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3064	AcroRd32.exe
3064	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2184 wrote to memory of 2824	2184	cmd.exe	29
PID 2824 wrote to memory of 3064	2824	rundll32.exe	30
PID 2824 wrote to memory of 3064	2824	rundll32.exe	30
PID 2824 wrote to memory of 3064	2824	rundll32.exe	30
PID 2824 wrote to memory of 3064	2824	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\views\battleInjector.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\views\battleInjector.pyc
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\res\scripts\client\gui\pmod\views\battleInjector.pyc"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
01c621f813630779455d3c5912b5482e

SHA1
49dcb4ac75be4a3b41cd65fea37de7383b560eea

SHA256
e4ded04e11ab93c6c728c80b8b0e2ca6056a3d15c9175b4a296f898a9d6a9b58

SHA512
ee743caa60c90303962eede62264267d2bb38ab00890e7c172ca026ec056958070a0447dcf49ae6be82fce107119062ccdf6fcda32aa68f1f3df4c3ac05104d3

Download Submit