99f6f8be1109ee646f82010738a0f7062a144e580d994fe0b78ded9bb6b5b9c0

Analysis

max time kernel
0s
max time network
5s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 17:39

Target

xniggerskid.pyc
Size

261B
MD5

e364efda858cba310df340504e07207e
SHA1

dedb71278a24798e97d3603e3c5d390b59d131be
SHA256

99f6f8be1109ee646f82010738a0f7062a144e580d994fe0b78ded9bb6b5b9c0
SHA512

e345672083cc0776cf2f41311992715aebd529df889ca7fc3c620c0c8e2fc305528128c97c943b0b137ddf75318690c7df08a8a01fa3659b425de1c7dfcf2ce5

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 1996	2268	cmd.exe	31
PID 2268 wrote to memory of 1996	2268	cmd.exe	31
PID 2268 wrote to memory of 1996	2268	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
  2⤵
  PID:1996

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact