1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

settings.dat
Size

152B
MD5

2daa93382bba07cbc40af372d30ec576
SHA1

c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA256

1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
SHA512

65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.dat	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2584	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2584	AcroRd32.exe
2584	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2884	912	cmd.exe	29
PID 912 wrote to memory of 2884	912	cmd.exe	29
PID 912 wrote to memory of 2884	912	cmd.exe	29
PID 2884 wrote to memory of 2584	2884	rundll32.exe	30
PID 2884 wrote to memory of 2584	2884	rundll32.exe	30
PID 2884 wrote to memory of 2584	2884	rundll32.exe	30
PID 2884 wrote to memory of 2584	2884	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\settings.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\settings.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\settings.dat"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ec113f95a4eae5e01443ea2a3bf991bd

SHA1
04478fc958b80dbd703d30c6bfa5017db0482940

SHA256
84f5121aa4ccec41d419631d15e80881b018694410844a90195e181b6b3d4b9e

SHA512
9a9a07c197e71a9df28d19ee7db9ecd5987f240b6dbf0298ac7bf18bf6fd319042861722b0e600da8c90d36a3bdd09d230975e1eec75d14d86ee782881ae261e

Download Submit