a618741c9fac2dcf1fe823eb335b696eac70866614a5e75b8f8e7a878f0f0746

Analysis

max time kernel
150s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/07/2023, 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ecurl.dat
Size

8B
MD5

8f376290b7ac9402f71824226ce2ecdf
SHA1

2c789b4b75c0b32f71ccbf7c745228c13be6d582
SHA256

71770d96b8d5206d0a68f53ee73ab88fc7eed6b0d25e8160eac422b86af79171
SHA512

657c162fdc2f074ed7c352c8e2c973b5e1a69fe7a3ca529b880ab729de0cb05012fc23a43390591f05d6cbda450499a14b01e6b7f77c7d088cdad04eea29049d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2624	AcroRd32.exe
2624	AcroRd32.exe
2624	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 3052	2152	cmd.exe	29
PID 2152 wrote to memory of 3052	2152	cmd.exe	29
PID 2152 wrote to memory of 3052	2152	cmd.exe	29
PID 3052 wrote to memory of 2624	3052	rundll32.exe	30
PID 3052 wrote to memory of 2624	3052	rundll32.exe	30
PID 3052 wrote to memory of 2624	3052	rundll32.exe	30
PID 3052 wrote to memory of 2624	3052	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ecurl.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ecurl.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ecurl.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1312eda69a6fdcf50695f28a47f173b1

SHA1
dd35bdb1b9677707fbebe7bd696771367179b995

SHA256
c7a3979ee1b8fc230110ef9a2000f1279644da85bc716fb5d710b2037314be06

SHA512
6f576e73950478db1dc710ee8734fa137b5ca6a8e36f560b84b059ab334283d8eb53e5d24ccaf831041a35ac77c5289d5d0bff75073798cb99952ed44ee61c1f

Download Submit