05451b195a176fa75fb7a8de600068e1f08b2a0b5cef42eef8439ec28ed26a59

Resubmissions

27-04-2024 19:36

240427-ybnfasfc9t 7

27-04-2024 19:12

240427-xwpy7afb2v 7

27-04-2024 18:20

240427-wy4ppaed6x 7

Analysis

max time kernel
117s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 19:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

icudtl.dat
Size

10.1MB
MD5

d89ce8c00659d8e5d408c696ee087ce3
SHA1

49fc8109960be3bb32c06c3d1256cb66dded19a8
SHA256

9dfbe0dad5c7021cfe8df7f52458c422cbc5be9e16ff33ec90665bb1e3f182de
SHA512

db097ce3eb9e132d0444df79b167a7dcb2df31effbbd3df72da3d24ae2230cc5213c6df5e575985a9918fbd0a6576e335b6ebc12b6258bc93fa205399de64c37
SSDEEP

98304:OKPBQYOo+ddlymOk25flQCUliXUxiG9Ha93Whla6ZGdnp/8k:OKPBhORjOhCliXUxiG9Ha93Whla6ZGrn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\dat_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1432 wrote to memory of 2572	1432	cmd.exe	29
PID 1432 wrote to memory of 2572	1432	cmd.exe	29
PID 1432 wrote to memory of 2572	1432	cmd.exe	29
PID 2572 wrote to memory of 2588	2572	rundll32.exe	30
PID 2572 wrote to memory of 2588	2572	rundll32.exe	30
PID 2572 wrote to memory of 2588	2572	rundll32.exe	30
PID 2572 wrote to memory of 2588	2572	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\icudtl.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\icudtl.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\icudtl.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
dd1b840bf69ac1a3a3a16bf2dd5a89eb

SHA1
066d8edb15ec0eed71786cd659986b99c0de66fa

SHA256
175ffa584869bfa40aae07cd0d8c614d36a4e9cb5cd34ab9002d319f33ef7c05

SHA512
f82e54d137488e223ae6adecfcc4a610ca9c05203280a234310608ea004f960799b05e43c18783106e63d6f8372dbadb631cf39aaf6dc5b159e7969754019542

Download Submit