5936791f7b6363530211e14f8d2f1ddc828df261f5116ab39ce73c50ad90c75d

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rrpy/DZSB/Replace/emperor.yft
Size

5.4MB
MD5

41991d306c75d67df6989acc6359c561
SHA1

5d667529c945bd50ae7d128af16ca01544fe565c
SHA256

e419b04a0b43993b36b282ddfbf6ca6c5f8903dd7d2544e4a6f0c504ab34de62
SHA512

aa01272e3a4af085ff325dd798f018ca306c7d373da8dc29dbf0bceb5025a549f07552bdd85dd429145e97b1b17ab5443e5569bcdeecc9ba83cb42a169fcfafb
SSDEEP

98304:ali4RjRKrQuwAsG2lbZskztr5nhtazreZjQvnzIJIGdp2rAOV0FEniI8WKw5eAR:x4RjRKrQK+ZZsk3htwiZjQLRrZVJ8WKs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.yft	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\.yft\ = "yft_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\yft_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 2824	832	cmd.exe	29
PID 832 wrote to memory of 2824	832	cmd.exe	29
PID 832 wrote to memory of 2824	832	cmd.exe	29
PID 2824 wrote to memory of 2812	2824	rundll32.exe	30
PID 2824 wrote to memory of 2812	2824	rundll32.exe	30
PID 2824 wrote to memory of 2812	2824	rundll32.exe	30
PID 2824 wrote to memory of 2812	2824	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor.yft
1⤵
- Suspicious use of WriteProcessMemory
PID:832
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor.yft
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor.yft"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ee60b222c9b3dbdaefd8b6d47578f4ea

SHA1
4f298eddb32580670e3b5f5c8cdb68482030e221

SHA256
2623c2852c946982eb2662eaf14ffa41fa440313c1f45ca745fd25a5fe63a2d2

SHA512
ae63b542b4af64014b1b0953ae82ea79a8fcf92b9b145cca3cbc11be595265cbdb6d2fb9f1b5f6dc6e5c54ff1aa38de941047b7ac7cd519be045397bfa139bb3

Download Submit