9683dad3cc31d814b93ee8e0968ae39773e194ccb20923e47caa5622d94f91f5

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15-10-2024 17:41

Target

xniggerskid.pyc
Size

261B
MD5

0469494f88fc0a550f06abe99ea04363
SHA1

63b3469380dd035d456c856f55aab30bfaa9dbeb
SHA256

9683dad3cc31d814b93ee8e0968ae39773e194ccb20923e47caa5622d94f91f5
SHA512

a263a54aac5a38c5360f183a2987e1e712d8a3e379ee98bfa2d9491a0810e7b5a08add81bc1418ac9c734e611f5f29543779f139f1c266cc0ad49ce9a9d0ae66

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2068	2668	cmd.exe	31
PID 2668 wrote to memory of 2068	2668	cmd.exe	31
PID 2668 wrote to memory of 2068	2668	cmd.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
  2⤵
  - Modifies registry class
  PID:2068

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact