31a31c494ae654a627381a13fd164b7ec9f91376bbf4fb75263aa999b601fb2f

Analysis

max time kernel
0s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 04:34

Target

54815f0f90eedd86ec3f7aad2669d0ca.jad
Size

61KB
MD5

54815f0f90eedd86ec3f7aad2669d0ca
SHA1

3d319fc8236975d93cfcbb7f355c4221746c743d
SHA256

31a31c494ae654a627381a13fd164b7ec9f91376bbf4fb75263aa999b601fb2f
SHA512

b10be0031bb29c3cea1294249ec3e28d8d47e0bb3f64a5e164127799192bcf54efc5c93171834cea17fe7a9b830d15b8e6f878914805255bf7d892606e262c51
SSDEEP

1536:2BFDvKvAYhXKrnlEGEW1MbBs5h+Clfp/NQy:2BFD8hXKrlEGEW1MdM+2fp/NH

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 2696	2296	cmd.exe	15
PID 2296 wrote to memory of 2696	2296	cmd.exe	15
PID 2296 wrote to memory of 2696	2296	cmd.exe	15

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\54815f0f90eedd86ec3f7aad2669d0ca.jad
1⤵
PID:2696
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\54815f0f90eedd86ec3f7aad2669d0ca.jad"
  2⤵
  PID:2800

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\54815f0f90eedd86ec3f7aad2669d0ca.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2296

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact