a3807794c390acc037b4de2d88f9869406ec661946af0a9e4a06cbe1ee0ba4a5

Analysis

max time kernel
155s
max time network
35s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30/06/2023, 18:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07_Zuri_Dcast.json
Size

1KB
MD5

389f61d4ed70cbcd8c7729934deb8495
SHA1

57e00551782f6e1bdde459bf5ee612b1cac9d30b
SHA256

20b8662df02acadf706545418054db27bfb958006757fb0ded36dc103e127246
SHA512

4a201b106679c775e698dadf6803495acd9ee2d8d74eeb978a57fce55e6bccbcc18d3292160bde1386076eb6da638090aef0a9487272ecbda19c2ef9e1428769

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\.json	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\.json\ = "json_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3465915139-4244146034-2076118314-1000_CLASSES\json_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
696	AcroRd32.exe
696	AcroRd32.exe
696	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 560	1756	cmd.exe	29
PID 1756 wrote to memory of 560	1756	cmd.exe	29
PID 1756 wrote to memory of 560	1756	cmd.exe	29
PID 560 wrote to memory of 696	560	rundll32.exe	30
PID 560 wrote to memory of 696	560	rundll32.exe	30
PID 560 wrote to memory of 696	560	rundll32.exe	30
PID 560 wrote to memory of 696	560	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\07_Zuri_Dcast.json
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\07_Zuri_Dcast.json
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\07_Zuri_Dcast.json"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:696

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
af0344a08771b4901cb4bf2d7ba42a2d

SHA1
ab7e169fc87bc9c0d6fceae2393222ebd19a3919

SHA256
af48ac7686e8d4c72f4d21b6bd7f8249d213206068d74db6491c5a28f3fe664d

SHA512
cb668f62ef43eee578973c44ed75f3f03654e931599d7b21a850906fc657c0a1f920966e8dce38cbc6f9a3c729ec75e5d6445a3c3ac2674ae4886212e25f5193

Download Submit