5936791f7b6363530211e14f8d2f1ddc828df261f5116ab39ce73c50ad90c75d

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

rrpy/DZSB/Replace/emperor_hi.yft
Size

5.4MB
MD5

f344fb7f26d79ac2f346845af425f658
SHA1

c1afbc0ee5e86e654d76d8ee7b100d1100cbff55
SHA256

7a42332625607471f8957c43c172c138a139d3109260e9a88cf7c90249f4482d
SHA512

7f7f26ac4062344dffec2a034b24843de63ded48161a988ff8cd1c6388c19a8f3b63547d55d53acf373ab5e914eb5bd6c51abe21bdcec05c7bb2b303131aacf5
SSDEEP

98304:nuSlVYCNkDWfEWUVLRp3eLl+ZFQkCSOfM2ZsLi9ocQmFYKFCB6l6Hx9BWik6FGfJ:nuZCNQWcJLRp3s+ZFQyOBj9h6iAzo16E

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.yft	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\.yft\ = "yft_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000_CLASSES\yft_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2868	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2868	AcroRd32.exe
2868	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2744	2500	cmd.exe	29
PID 2500 wrote to memory of 2744	2500	cmd.exe	29
PID 2500 wrote to memory of 2744	2500	cmd.exe	29
PID 2744 wrote to memory of 2868	2744	rundll32.exe	30
PID 2744 wrote to memory of 2868	2744	rundll32.exe	30
PID 2744 wrote to memory of 2868	2744	rundll32.exe	30
PID 2744 wrote to memory of 2868	2744	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor_hi.yft
1⤵
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor_hi.yft
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\rrpy\DZSB\Replace\emperor_hi.yft"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
884feadf7d3b352f38565c12f571389b

SHA1
d302df42ceca1ff5cb21749a08f333852e398676

SHA256
d4ecaff240d9c864b01fd4f4a350eeeacbc033ffd8a04825bbeecbf9bc1c3165

SHA512
7b62d239ec781c47fc5aaf0e222ad2b906ac59778ea2d9653407fa3858de9651ced0f57ea9b5adfb06a55d8594e77676722180e51d9acf8cc5382afd52fac9f2

Download Submit