6baa72f1363b421eb90a55654ba36c34521a42a9cddb2ed6a0b8a90c953274f7

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Raptor MultiTool/Raptor-Login.py
Size

10.0MB
MD5

0dd1c950fc2a4d4e3032caeb40ac11f0
SHA1

77495a7c05ba4e2e532995c4eedc82a62c5eb171
SHA256

e1dd6f14a8a4dab7c48f681e1d82ff8fc5cc38556d37c5000c136fd335cb875f
SHA512

5eb8df2290e06b1f47825b7db20163b5fc4b0301b6c09a8474859499ee73b4ab2205b3bb6a669a726e83dc937a60e85faf15709e5bccf17e34c0a3c838fc8bf0
SSDEEP

768:0RL7qOcrowVw/lfPIeHxONHGb2yafsTf6KFmfm55A:c7VcrLVw/lfPPHxOIb27kf6fWG

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2040	2940	cmd.exe	29
PID 2940 wrote to memory of 2040	2940	cmd.exe	29
PID 2940 wrote to memory of 2040	2940	cmd.exe	29
PID 2040 wrote to memory of 2668	2040	rundll32.exe	30
PID 2040 wrote to memory of 2668	2040	rundll32.exe	30
PID 2040 wrote to memory of 2668	2040	rundll32.exe	30
PID 2040 wrote to memory of 2668	2040	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Raptor MultiTool\Raptor-Login.py"
1⤵
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Raptor MultiTool\Raptor-Login.py
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Raptor MultiTool\Raptor-Login.py"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1d95dd361e5d80a3efbc0f87efb7beed

SHA1
802a7efd0a0644a348d7c209b924ee2c90cd52f4

SHA256
e44813aae3647509ed9d8afe42cef505d427a6c4ae093f44d6af05699e095ebc

SHA512
a55a18db664474fad5e6814327956d85d2ca40a80d6d46345f5a4cfbb275ebe86239ef5feaae7fa66600c9ab1f02e5be00d05358bc99ad7f1024f29e8993c8a7

Download Submit