e4ce6be4c0e8718cb3297d73bde43f5c77ca0369c1b4a501c5306ce1d84e26f1

Analysis

max time kernel
128s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29-12-2023 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04412e984f95e6e21292e7ce35e1e5c7.jad
Size

854KB
MD5

04412e984f95e6e21292e7ce35e1e5c7
SHA1

5ad201e229d125c60829a0875e75c846dada44af
SHA256

e4ce6be4c0e8718cb3297d73bde43f5c77ca0369c1b4a501c5306ce1d84e26f1
SHA512

847f066da640d0a214fff893f8aa0b0a3e27d3fc90ff45dda1912676f9d24038d545b753563187e37eff7fc4b1b80870d136dfdcf479ea7dcf00a981e1624c90
SSDEEP

24576:5oujmuGD+1r/j7oisJQaDeMcH8tkbdgttafd6:5pmuG8rjIQaDeMcSkJgifd6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2084	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2084	AcroRd32.exe
2084	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2708	2104	cmd.exe	29
PID 2104 wrote to memory of 2708	2104	cmd.exe	29
PID 2104 wrote to memory of 2708	2104	cmd.exe	29
PID 2708 wrote to memory of 2084	2708	rundll32.exe	31
PID 2708 wrote to memory of 2084	2708	rundll32.exe	31
PID 2708 wrote to memory of 2084	2708	rundll32.exe	31
PID 2708 wrote to memory of 2084	2708	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\04412e984f95e6e21292e7ce35e1e5c7.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\04412e984f95e6e21292e7ce35e1e5c7.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\04412e984f95e6e21292e7ce35e1e5c7.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2103fdfd8bf28844dcb19e29c41aa1cb

SHA1
7d3ff12ec0bd248f4964ee227f8b3bc70dd66bd0

SHA256
8b620c588eeb15eebb7d123ee5b4308a4696c9e0f37499f490db33bdc252d713

SHA512
c1f728cd10284f602081457420dd3946fa58e762fade3afdf1f1aa8aeb14a9c6c35dc3b3f43c741cf044d9b57ba117a269ee3981a574919c32a5278ff3a8f3c4

Download Submit