Analysis

  • max time kernel
    120s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    21/04/2024, 13:16

General

  • Target

    icudtl.dat

  • Size

    10.1MB

  • MD5

    62880b7d351a9f547b62b8da6c97ce25

  • SHA1

    057f11003013cfb3f1c63e6bdd4f2f9949ff0104

  • SHA256

    7c40c811d30d459dbf04a04c141b60eb4247cd58a008fb836605317df665748f

  • SHA512

    0d6f83175a91d90f4cc3ec4d9071b7acd0cd8ebbcc592322e46fde2adb7198e035af62c45a11a622f2a908e26d4dd8b8d1af023e634a74d0824d02c791ba3c1a

  • SSDEEP

    196608:1IPBhORjFQwCliXUxbblHa93Whli6Z86WOH:1kwVAliXUxbblHa93Whli6Z8I

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\icudtl.dat
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\icudtl.dat
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2520
      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\icudtl.dat"
        3⤵
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:2392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

    Filesize

    3KB

    MD5

    b79fcaebd0fa47565f63634937a475be

    SHA1

    81a4df2d727e91c6f116da81b04dd1344b9c3e1a

    SHA256

    b0e6f988509df5bcda20c7d85e8c6f93a41538235ba7ea95af89a28dbc1c3743

    SHA512

    c47ac35fbf9781308c64091a69972a46e5328f0b9ddf185b3daa5ade348eea20b3d4576d78d948f38bb3ac3a0a50e7a4714fd7ef786ac6f9ba8c7513c43c6a4b