eac0f3d162b8aa13eb8095fb3c871f6a787bc287f7afb9eb49993a3396c2a31f

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 11:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

icudtl.dat
Size

10.1MB
MD5

adfd2a259608207f256aeadb48635645
SHA1

300bb0ae3d6b6514fb144788643d260b602ac6a4
SHA256

7c8c7b05d70145120b45ccb64bf75bee3c63ff213e3e64d092d500a96afb8050
SHA512

8397e74c7a85b0a2987cae9f2c66ce446923aa4140686d91a1e92b701e16b73a6ce459540e718858607ecb12659bedac0aa95c2713c811a2bc2d402691ff29dc
SSDEEP

98304:ffPBQYOo+ddlymff2LfPQCvliXUxiG9Ha93Whla6ZENSs285:ffPBhORjfAHliXUxiG9Ha93Whla6ZEV7

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000_CLASSES\.dat	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2684	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2684	AcroRd32.exe
2684	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2376 wrote to memory of 2520	2376	cmd.exe	29
PID 2376 wrote to memory of 2520	2376	cmd.exe	29
PID 2376 wrote to memory of 2520	2376	cmd.exe	29
PID 2520 wrote to memory of 2684	2520	rundll32.exe	30
PID 2520 wrote to memory of 2684	2520	rundll32.exe	30
PID 2520 wrote to memory of 2684	2520	rundll32.exe	30
PID 2520 wrote to memory of 2684	2520	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\icudtl.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:2376
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\icudtl.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\icudtl.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
bfcbe5773c5c07852c99ddeb8cc43219

SHA1
9116125f05e863814436b746ca7d6119fd2b5a37

SHA256
3d5828a3c1249bfdb5e16cc19dcd0342e80364e6a07be3854af7736f6bc0f2ee

SHA512
a03d762106c5953c051ab7c1c5e1b6d9934eb25398986ac307849e692f759f3ed8ce5f4359b92a3edec43c4f76f8069255ed039350473de251e6b024eba3a272

Download Submit