e80b6616e4ce244cc349a247f8dbd90de941be208167732ad102ab850fc86bbb

Analysis

max time kernel
120s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

32620ad973d5402840963fe0325515c3.jad
Size

20KB
MD5

32620ad973d5402840963fe0325515c3
SHA1

4d7ac0cfc664d6a8d47d4bdcd10a05a1f67ae2a8
SHA256

e80b6616e4ce244cc349a247f8dbd90de941be208167732ad102ab850fc86bbb
SHA512

a44adc60aca143e77dc66f5a71bac7d7efcdc7a531fce74012eb5aea89d8eca9f9be13a8bda1f336a74d6545824e5b60b4de175ba940b9b30d553ac86034b5eb
SSDEEP

384:T2nXWpDhmhZczSbLS84cvN/o87m38F7B/S4WKwaubXopnHmjlBS1grNkhVkP28:T2ax2y8xVo87m3n4gHXQj1gr0e28

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3008	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3008	AcroRd32.exe
3008	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2836	3012	cmd.exe	29
PID 3012 wrote to memory of 2836	3012	cmd.exe	29
PID 3012 wrote to memory of 2836	3012	cmd.exe	29
PID 2836 wrote to memory of 3008	2836	rundll32.exe	30
PID 2836 wrote to memory of 3008	2836	rundll32.exe	30
PID 2836 wrote to memory of 3008	2836	rundll32.exe	30
PID 2836 wrote to memory of 3008	2836	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\32620ad973d5402840963fe0325515c3.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\32620ad973d5402840963fe0325515c3.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\32620ad973d5402840963fe0325515c3.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c2818071b640e811bb24a37d4cb1663a

SHA1
ec235d18fb4c56e1fb519d539dc3f49038c52ab9

SHA256
d6fec0f0bda46b3f53200a30732a998d6e889e354905e7bc5ba01ea4d3cc981e

SHA512
3f86f4000553f592ef1a7b89179c781c2e7969cb4f6959a7a8f2e62fa64d6c4c9368572de9f7a56b3b4a25a69862562225f326c2b372000aa3064cbf3ec23262

Download Submit