22fd797135e418d97b07cbeabd30402f2cbc01f93c513c92ea3d77dce262f40e

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Jimm.jad
Size

268KB
MD5

39ea1feb70c6bd2662f9c73e5fcf83f8
SHA1

5b92857aceeb607bd7393c5e92be82ea3beefc5c
SHA256

b57bc429ef0e1e8b5b5d07604622e668a3473bb266a91cb8a8ba0633183ec443
SHA512

3c00b228e0471095f4adefdab70854a77846c58c237fcdc5affa5481b98bb8796e92156f920f122ed21de68349c8cb35b388374df9c390382820bf61219d05f6
SSDEEP

6144:sCw6UQVN6kDh9vdY9TtFwkjdQ+mR5ppMPWKt7+pInMeYzob:sG5bvcT7ifJpMuKteI+A

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2892	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2892	AcroRd32.exe
2892	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2664	2620	cmd.exe	29
PID 2620 wrote to memory of 2664	2620	cmd.exe	29
PID 2620 wrote to memory of 2664	2620	cmd.exe	29
PID 2664 wrote to memory of 2892	2664	rundll32.exe	30
PID 2664 wrote to memory of 2892	2664	rundll32.exe	30
PID 2664 wrote to memory of 2892	2664	rundll32.exe	30
PID 2664 wrote to memory of 2892	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Jimm.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Jimm.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Jimm.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
30252f62fbb26da52bba74f1a5dbb1a6

SHA1
56c067d0d12e1c42e4859711622d63b5fc2d7de2

SHA256
af5230fa5c2ba747aea6e737084fc7150f65750c8b02c089c7f0ef31a334e347

SHA512
0913e4aab0e9f1a85d28c32b4cba2b82028bb021dc497aeeafe91ad143aefae3737506b4186cd4635f885e612e043c0899452d45a85090ba95742c7d51c1b0a6

Download Submit