1d9816fdeeaa67cca91184338cf5bbdc3848fc98a74ddb20997b45cb34d12a63

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

04e93260cc8c80e8339d552127752d97.jad
Size

6KB
MD5

04e93260cc8c80e8339d552127752d97
SHA1

53551b9adfc9a9ef66b0cf04b0a018cde1b00b6a
SHA256

1d9816fdeeaa67cca91184338cf5bbdc3848fc98a74ddb20997b45cb34d12a63
SHA512

1056aa92ccca7eb73b4cd97b4feeb08bf1f3f6e06eb325ae36141e39f55c311891a75201b07a7dc8fa27a90dc4440baec0f525e84213ec4353c1ad56d977f4ba
SSDEEP

192:piR74X7U0hL1OfCWo71Yh3oMzglGM8e6KBFt6ex:I14X7U0dQfCv7Sh3/VMvnBCex

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2652	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2652	AcroRd32.exe
2652	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 3056	2724	cmd.exe	29
PID 2724 wrote to memory of 3056	2724	cmd.exe	29
PID 2724 wrote to memory of 3056	2724	cmd.exe	29
PID 3056 wrote to memory of 2652	3056	rundll32.exe	30
PID 3056 wrote to memory of 2652	3056	rundll32.exe	30
PID 3056 wrote to memory of 2652	3056	rundll32.exe	30
PID 3056 wrote to memory of 2652	3056	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\04e93260cc8c80e8339d552127752d97.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\04e93260cc8c80e8339d552127752d97.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04e93260cc8c80e8339d552127752d97.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
96810fd8bbaf97b5933ceafa737b7ddf

SHA1
d8dd27fe06de502f11e7ead555d1bab95e403e2b

SHA256
06481f1df9576da7f59b5472596f2d0de5df508580e16ddfa11994e977e6b6ac

SHA512
21921a7b4bb85661004e01e134eea3176db1fae179cc35f17f9927eb5acf485fa46499d3d9b3e4bea6ce72505a6b580fc36536723dd502ac37f35fcf23bfdf13

Download Submit