2b86d881171d2c4605294f2482a01c12cb93555511e7762b36398e6893ef0eb9

Analysis

max time kernel
159s
max time network
137s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
18-09-2023 09:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

System.Data.dll-resources.dat
Size

91KB
MD5

4860ddd4350579f8fcacb1881582335a
SHA1

493c03e9cfef6f72a00f92023cdb88527dfdf72c
SHA256

98a7950ec6de3242c2e190dfa630188dfa32511a125542b94baa952d1c757d49
SHA512

51421a1e79914cb6d828305103c5f7cdb020d98107586abd7e04614f65bae8004101e5567a873f52fe2daa3a7984bf4f7a4930e628cc5f86e709e3a37f812a95
SSDEEP

1536:lgFLFsFLFac1cWcvFMF+F1cIFaFnF0FBFdFzF+FUF8FvFOFvFNciFEFvFxF5FHFj:lgFLFsFLFac1cWcvFMF+F1cIFaFnF0FI

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2292	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2292	AcroRd32.exe
2292	AcroRd32.exe
2292	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2652	2100	cmd.exe	29
PID 2100 wrote to memory of 2652	2100	cmd.exe	29
PID 2100 wrote to memory of 2652	2100	cmd.exe	29
PID 2652 wrote to memory of 2292	2652	rundll32.exe	32
PID 2652 wrote to memory of 2292	2652	rundll32.exe	32
PID 2652 wrote to memory of 2292	2652	rundll32.exe	32
PID 2652 wrote to memory of 2292	2652	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\System.Data.dll-resources.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\System.Data.dll-resources.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\System.Data.dll-resources.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c2ef2e03642409433e8bb9ad8be4a1ef

SHA1
4ed4813eb9c3f8f94322e398ee9831b9d66ab032

SHA256
b361e0c02f208dc4bb79e393d7b325101ecd917571469c6507be88fdc8d1d249

SHA512
15e0e393d466e142c00b204b981926e6da13dea2047f0d09f2c326471a4429ef8d7fa9f3ec1dd842576ea4e16f9938cefc8a0eafa197ab6c265b79129e120d5b

Download Submit