30cfdd58aa66edc0254adb7b4d36106be3e3ed7329da2f5fd3fb6110b5be0886

Analysis

max time kernel
164s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69e3d14e3e48791296272096c2ebb16e.jad
Size

8KB
MD5

69e3d14e3e48791296272096c2ebb16e
SHA1

ca8cedd011c8ee4465d4bd4fcf97c302b043515f
SHA256

30cfdd58aa66edc0254adb7b4d36106be3e3ed7329da2f5fd3fb6110b5be0886
SHA512

ea15c659b5a289c63af7df5e05bb1d73a3b863a31dd0e51f1abcf91a8560325a8c4f263213d63035817d6e9f9e636365728c066db00c5df90a3109c8f42a4464
SSDEEP

192:7oC+ePesZmFglFejH4/R1k6AW75VKtcy0h2:7oLYNmFoU8mtcHk

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2808	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2808	AcroRd32.exe
2808	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1652	2676	cmd.exe	30
PID 2676 wrote to memory of 1652	2676	cmd.exe	30
PID 2676 wrote to memory of 1652	2676	cmd.exe	30
PID 1652 wrote to memory of 2808	1652	rundll32.exe	32
PID 1652 wrote to memory of 2808	1652	rundll32.exe	32
PID 1652 wrote to memory of 2808	1652	rundll32.exe	32
PID 1652 wrote to memory of 2808	1652	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\69e3d14e3e48791296272096c2ebb16e.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\69e3d14e3e48791296272096c2ebb16e.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\69e3d14e3e48791296272096c2ebb16e.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
00883e6d304e817069f38cada3f7667c

SHA1
8e0234cacb3c395dc18c57f260bdc7c752cc7c46

SHA256
6fdf54d9240123252f3fa06218ea121f17c41c3ca1460b20e353ac2f2c441a27

SHA512
fd3fbb8cbe58702bb3a2cc16b9eb8754e6755bf91f1d1026deb089a6567606ab2b58f3889a020ade56ab45e0fd011109ea00fefcb70ee2865fbb9af3259a8b10

Download Submit