e941815c19a76118fd93e1031a2392f9d122a1dbadcaa1f688164c6134f66458

Analysis

max time kernel
0s
max time network
1s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 17:36

Target

xniggerskid.pyc
Size

123B
MD5

5b72221ab0ba3eae642f5e1f87be2fd5
SHA1

934d4250fe0c9c528c3c5978f1a3981bf3b5dd90
SHA256

e941815c19a76118fd93e1031a2392f9d122a1dbadcaa1f688164c6134f66458
SHA512

5ebc687e3c457cfaab0bf100d212ea43a05e527af9cfb754a00c145a661b011584b16b5bf447078d0e944d6a82bca3257836438fca358d696276c7e5502c4a81

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3012	1684	cmd.exe	29
PID 1684 wrote to memory of 3012	1684	cmd.exe	29
PID 1684 wrote to memory of 3012	1684	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
  2⤵
  - Modifies registry class
  PID:3012

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact