29f331c8ea62d886c3a8b37f0f3850db1706e08384f7762da7ce23d0e17a446e

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/12/2023, 21:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12a04896b92e5c0472d6e21f4042a55b.jad
Size

4KB
MD5

12a04896b92e5c0472d6e21f4042a55b
SHA1

28ca046e921fe165600830c963e9cdfcdb28535c
SHA256

29f331c8ea62d886c3a8b37f0f3850db1706e08384f7762da7ce23d0e17a446e
SHA512

eaf3500f304ac4b5c5f9952742fd621ee5493f09895c3a3e04ea39f2fffb669fc5366f82a499f689240bd6b088d224a83db16b13fa736fe8da050b00a5c9e02c
SSDEEP

96:7VTtsgFCN0RuVRy6kd0Zoelq1ulDPDOtmyMP:7Z+4CGAZXPdPDn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2604	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2604	AcroRd32.exe
2604	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2792	2208	cmd.exe	29
PID 2208 wrote to memory of 2792	2208	cmd.exe	29
PID 2208 wrote to memory of 2792	2208	cmd.exe	29
PID 2792 wrote to memory of 2604	2792	rundll32.exe	30
PID 2792 wrote to memory of 2604	2792	rundll32.exe	30
PID 2792 wrote to memory of 2604	2792	rundll32.exe	30
PID 2792 wrote to memory of 2604	2792	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\12a04896b92e5c0472d6e21f4042a55b.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\12a04896b92e5c0472d6e21f4042a55b.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\12a04896b92e5c0472d6e21f4042a55b.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f72c32fa9921a033beacf8cceb57833b

SHA1
0c04132da3de94aad0ddb4bc2d38dd7747174990

SHA256
6f4aff88a77a3c295387b846b2569ac93febd6686c520eae7c21516c4b676d7f

SHA512
30b1274ed22e5dd75cf4cd4734f647387b4148d168ef7212ef35ca61d58760c173b7d9116e9164679bad4e5022ccb0f834184bd592c4d638ff062ab9b7c1f9b1

Download Submit