be4b7ce185c2ae9640894b97e30b3faa9d99794560638fcbd04935b5f74d6e4d

Analysis

max time kernel
316s
max time network
403s
platform
windows10-1703_x64
resource
win10-20240404-it
resource tags

arch:x64arch:x86image:win10-20240404-itlocale:it-itos:windows10-1703-x64systemwindows
submitted
18/06/2024, 18:44

Target
NiceRAT.pyc
Size 74KB
Sample240618-xdvrqaydkm
SHA256 4bd9a94d4fb9d0f880b0f74fa0bb376b696d6283e174776346d3a7d5c2f58bd1
MD5 05f2838338b63bf11a142848acb66731
SHA1 5a938ffcef3b3b4abc79c25a4ec59d197e8bf4a7
SHA512 7660d0d9d4248c29c3c1c7b353986dfb7e8194507b10904436cf9adab5109a0ae07ba5721d43c3c3775d633f08eff8013cdd3ee6f4346279bfba65e51545b45e
SSDEEP 1536:Jkx+peIUJlJ/x2IsVCR28r78sgo6wtkzrTSR/em:JkiW2IsVP8ssgonkzrTSRd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000_Classes\Local Settings	OpenWith.exe

Suspicious use of SetWindowsHookEx 3 IoCs

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NiceRAT.pyc
1⤵
- Modifies registry class
PID:984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact