3e0faf2368d158b927fe8ddf8cc45c18465fd663545652dcf11812db0e039429

Analysis

max time kernel
34s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

updates/icudtl.dat
Size

9.8MB
MD5

65c6337820fbe9bf2498a9395e3b20f2
SHA1

5cc62646e6c73b4be276d08719bc5e257af972bb
SHA256

33da1cdda18eaea52011d40ae9a610cac9f6466156e9803891ee77294607aee4
SHA512

4800f03577a46a98a4bd786dc37a380f4169540e243fdb7835e3146fba0d0e1d07a7e3ec8cd23566feb00d204d582d678698ae61db156339fe56229de0b267c9
SSDEEP

196608:g7UPty2ACLA2cliXUxR0jHz93Whl96p6VJQ:V12CLAZliXUxR0jHz93Whl96p6VJQ

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.dat	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\.dat\ = "dat_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000_CLASSES\dat_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2848	AcroRd32.exe
2848	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2864	1560	cmd.exe	31
PID 1560 wrote to memory of 2864	1560	cmd.exe	31
PID 1560 wrote to memory of 2864	1560	cmd.exe	31
PID 2864 wrote to memory of 2848	2864	rundll32.exe	33
PID 2864 wrote to memory of 2848	2864	rundll32.exe	33
PID 2864 wrote to memory of 2848	2864	rundll32.exe	33
PID 2864 wrote to memory of 2848	2864	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\updates\icudtl.dat
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\updates\icudtl.dat
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\updates\icudtl.dat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
15632ece60a5808775dca727c99e82c8

SHA1
9f02070e2623a01cb80c45dc469759cd6a5cf961

SHA256
cd53e30603bdd0af7ba90e4415f3b45834132dac2f2d60f2aef8455038c3d3e1

SHA512
c2dbafaba526fe918f2e401055c71d788d58ac802c9bc95e71a50c033ab07588faa96e4e30368407311dd10ae6306b48d6bce7885fb2c22abc13a65e81fe0fb9

Download Submit