22fd797135e418d97b07cbeabd30402f2cbc01f93c513c92ea3d77dce262f40e

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 20:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Jimm.jad
Size

482B
MD5

380258fb6b467d576b56168dc1f762eb
SHA1

4bbfea34c01e30fbdb1dc3073e81c9f01fc1cc63
SHA256

de54a559ebd24815a08680cbca56967c2d753182d35c84587dd543cde42a9c22
SHA512

e84a7c859913a82b8038d817c721a89ac7ff6d6c87784d1aaf2b479ea8fed29aea8f22871b216d754d0e0d162dcb9e39206435aee0389f49821d8b3d3fead14d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2704	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2744	1308	cmd.exe	29
PID 1308 wrote to memory of 2744	1308	cmd.exe	29
PID 1308 wrote to memory of 2744	1308	cmd.exe	29
PID 2744 wrote to memory of 2704	2744	rundll32.exe	30
PID 2744 wrote to memory of 2704	2744	rundll32.exe	30
PID 2744 wrote to memory of 2704	2744	rundll32.exe	30
PID 2744 wrote to memory of 2704	2744	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Jimm.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Jimm.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2744
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Jimm.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
ef1a9291d52e5f7010c9a306c39b89c3

SHA1
0b96ebd9a897ff9d4a19dac57f48b41a3f614ab6

SHA256
9b87f6b320b2eb789bd68621546eefcfd2dae73ac30b6829e9d59bd92f7e7c85

SHA512
36b71581606f2b0e5f6efa688527e7c8b55201fd247c342fe0b2dad2b586764e70401c1cb44818c9eb9c4ef2ef726ef1c3b1530f58978339afcca5e3341dce1d

Download Submit