76faadb7a67b688f58951c537fa98d0f3cbc77ed01fa3fb18d16146d36b7a06b

Analysis

max time kernel
149s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
08/05/2023, 03:17

Target

content/data/data1.dat
Size

32KB
MD5

f630aebe17c6e2582e93711d2430e9e1
SHA1

328d9ebe8a74fdbbd85ca94550cfbe6c85eaf9da
SHA256

d89afbf41abafacad76124df4b43a212ec3a54424e6bdb9016053e1e0b043e4a
SHA512

8a2680c6f199cd17917a274822661e74162ef9968400f67f72009c3559495dbe741263addd3547499d4cf9955bfc8d56f0ec1224326f6b99b4a2836aa88b2ca9
SSDEEP

768:oxdx8x1xOxHxYxRxqxjx2xAxvxWxExUx2xoxvxCx0x2xibh:7

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.dat	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 672	2024	cmd.exe	28
PID 2024 wrote to memory of 672	2024	cmd.exe	28
PID 2024 wrote to memory of 672	2024	cmd.exe	28
PID 672 wrote to memory of 1688	672	rundll32.exe	29
PID 672 wrote to memory of 1688	672	rundll32.exe	29
PID 672 wrote to memory of 1688	672	rundll32.exe	29
PID 672 wrote to memory of 1688	672	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\content\data\data1.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\content\data\data1.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\content\data\data1.dat"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1688

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact