22fd797135e418d97b07cbeabd30402f2cbc01f93c513c92ea3d77dce262f40e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Jimm.jad
Size

257KB
MD5

cab3cab1326940828d23fc073c055f64
SHA1

3e341daf9ba9b121e845dfc3311510bc38f70091
SHA256

6dc68cc4a017eab76e16264e39357a7cf981e85b6b63b8edf9c87d76ee40b6bc
SHA512

ca37696bfb4cceec2a9b5b16c616894e0e5fd2b62d6a332b155a2fbfb64f80112e2fb13fa8d373606808c84411db4d0ece2678d033973c0fee3abaa5dc2b88ea
SSDEEP

6144:0eGUGgyo7Qmyfw7OHp2D8SmPieShI8na+pWozEX+ps:0eDGgHEfw7w8xeShI81IQs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2324	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2324	AcroRd32.exe
2324	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 2752	1396	cmd.exe	29
PID 1396 wrote to memory of 2752	1396	cmd.exe	29
PID 1396 wrote to memory of 2752	1396	cmd.exe	29
PID 2752 wrote to memory of 2324	2752	rundll32.exe	30
PID 2752 wrote to memory of 2324	2752	rundll32.exe	30
PID 2752 wrote to memory of 2324	2752	rundll32.exe	30
PID 2752 wrote to memory of 2324	2752	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Jimm.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Jimm.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Jimm.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
69d3b428070887c03dc1701f70e922f3

SHA1
cafcde1e363bdd0f2d8d3d67ec9fac35083f78ca

SHA256
27281a471a9456f9ad8e7f7bbae580afbe22a4f44abf11f8c8710281f765c405

SHA512
c8bf99d3a9c08faa07d211bf9760ea6aeb0f85e42b71ad9bbc6f737571e48ff6280ea80400aefc8bc859963a976b7dcfb00accf231d294c2d2f4c7e2613410ea

Download Submit