26bec904968a8dbf5b775690010f9df6769c8bd220369817a4a98d46f89cd07c

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e3f7b5bf5f1a17183467e546b05cab5.jad
Size

106KB
MD5

1e3f7b5bf5f1a17183467e546b05cab5
SHA1

f60ecda4f826d5bd33ab6dd9231022b42b5686f2
SHA256

26bec904968a8dbf5b775690010f9df6769c8bd220369817a4a98d46f89cd07c
SHA512

d533863fe3a0b5f977417aca8db5e29c6e43a4e21f36ac9a26fa2a5b962352204b221188b7ce080233eb71fdf33b65eba6a9bca89d991bcc41dae8a55ffc001b
SSDEEP

3072:yBocdZSz4+WT8pJbJPFUe26E1dXr0WZQ/BR4:CRL8pv561d70WZv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2896	2100	cmd.exe	29
PID 2100 wrote to memory of 2896	2100	cmd.exe	29
PID 2100 wrote to memory of 2896	2100	cmd.exe	29
PID 2896 wrote to memory of 2668	2896	rundll32.exe	31
PID 2896 wrote to memory of 2668	2896	rundll32.exe	31
PID 2896 wrote to memory of 2668	2896	rundll32.exe	31
PID 2896 wrote to memory of 2668	2896	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\1e3f7b5bf5f1a17183467e546b05cab5.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\1e3f7b5bf5f1a17183467e546b05cab5.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1e3f7b5bf5f1a17183467e546b05cab5.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
3779633d93af9be0011f9727d0f7a781

SHA1
86cf9a7c89b1dbbc471d834cf66a748a90817b06

SHA256
db1b95f2ad19f982efdf86d5f38526dea497ed1117b7489d81739747958d6824

SHA512
f1f2399ea977e1bc31f638f85851044f651eb5203ccfa4075537442b9e639ebe149fac753ca5c715ce7b67c40bda4f412d1268cb2c966c5f545d08ad9723931f

Download Submit