664cbe0dac20e3f37bdc9684e46432f80d5b84b63569949302ec72c8c0c23d90

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-10-2024 05:44

Target

xniggerskid.pyc
Size

261B
MD5

ef552f6a38511ec3881bdcb5a1b08017
SHA1

1fca7d31d054347de2233f5511595321d8911661
SHA256

664cbe0dac20e3f37bdc9684e46432f80d5b84b63569949302ec72c8c0c23d90
SHA512

f34ddb7220b465f19c0b8cb3be2d7e4c48d8c4e8beec9394aeacf7f44564479ad23c0ab96cdab03973fc34f331223b9d4f1102ad39fc36e16e4844f8e1a0aeb4

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000_Classes\Local Settings	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2736	2656	cmd.exe	29
PID 2656 wrote to memory of 2736	2656	cmd.exe	29
PID 2656 wrote to memory of 2736	2656	cmd.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
1⤵
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\xniggerskid.pyc
  2⤵
  - Modifies registry class
  PID:2736

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact