0432dca5d3f8623103c1e112f052a4ed7990d550b029c445858ffc94a9abe65b

Resubmissions

15/04/2024, 17:37

240415-v66nksed8w 7

15/04/2024, 17:34

240415-v5ll1sed3z 7

15/04/2024, 17:30

240415-v3fmzsca66 3

15/04/2024, 17:27

240415-v1vdcseb8w 7

Analysis

max time kernel
35s
max time network
21s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WindowsPowerShell/v1.0/Modules/MsDtc/MSFT_DtcAdvancedSettingTask_v1.0.cdxml
Size

3KB
MD5

5d3b6b8efdb22ab05507f985f511ce0a
SHA1

993e810d767b08df2adabad13d04dc8c5673b345
SHA256

2d892e242e809f9f00a74788aae4238f444c89457a14938fb8aad4368c69d107
SHA512

b47b83603aa15f3dc7b93ebc816b29da3231e65b4db0aa7e6e94a7516a57a85446b8a056c417637cc0ab50f5210659f03b3d23927093ce48d0a672a4563a969c

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.cdxml	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\.cdxml\ = "cdxml_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000_CLASSES\cdxml_auto_file\	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 2832	1668	cmd.exe	29
PID 1668 wrote to memory of 2832	1668	cmd.exe	29
PID 1668 wrote to memory of 2832	1668	cmd.exe	29
PID 2832 wrote to memory of 2556	2832	rundll32.exe	30
PID 2832 wrote to memory of 2556	2832	rundll32.exe	30
PID 2832 wrote to memory of 2556	2832	rundll32.exe	30
PID 2832 wrote to memory of 2556	2832	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\MsDtc\MSFT_DtcAdvancedSettingTask_v1.0.cdxml
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\MsDtc\MSFT_DtcAdvancedSettingTask_v1.0.cdxml
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\WindowsPowerShell\v1.0\Modules\MsDtc\MSFT_DtcAdvancedSettingTask_v1.0.cdxml"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
6fb0841d161a399c3e74ea878ffee9c8

SHA1
e3af968ed28ff1cdf9ea84a25d9fad378de73747

SHA256
42a0f5375943825d796f89a720220360f80893c5d04bd34b10f984138d76e423

SHA512
7adca103f827c621103ed28dbdfb31b3885d3ee5a33df90d0048f66925f90338c472dcdbee49159017ca6d5bd20a89748ab04bf7db3a3739d30ff742c9360488

Download Submit