4c70cd3376a28df4b10b6b51f8e5dbcb651be2fca1e109fa65fe54dcb7880855

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 03:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d02e44603f251213cff69ae2b2a7596.jad
Size

17KB
MD5

0d02e44603f251213cff69ae2b2a7596
SHA1

5c7af5fb30ac18d665cb80ca473e211cdfbadd06
SHA256

4c70cd3376a28df4b10b6b51f8e5dbcb651be2fca1e109fa65fe54dcb7880855
SHA512

2f3ef96953509bb43bfe70d75a25c7d471881a6540fc6f340077d0ca91b8e40a74c91505ff7e54991ae1c6821a14b9faaccf77799b561c9713ccffba24efcb79
SSDEEP

384:aP/Tlixy1qgskFkeRXHT94iphBjtLM3yhN6:qTStkFNRXCUjS3yhN6

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2632	2172	cmd.exe	29
PID 2172 wrote to memory of 2632	2172	cmd.exe	29
PID 2172 wrote to memory of 2632	2172	cmd.exe	29
PID 2632 wrote to memory of 2588	2632	rundll32.exe	30
PID 2632 wrote to memory of 2588	2632	rundll32.exe	30
PID 2632 wrote to memory of 2588	2632	rundll32.exe	30
PID 2632 wrote to memory of 2588	2632	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\0d02e44603f251213cff69ae2b2a7596.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\0d02e44603f251213cff69ae2b2a7596.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0d02e44603f251213cff69ae2b2a7596.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
c3efa0e11b390839fa2b9d391f9faaca

SHA1
3cac703ea78bec5aa1dc45a82d9d298b2296e978

SHA256
b20662c2c4786f18d576db0926a4bd7f89f9edead85ef8a7a75b32ca328f1a1f

SHA512
adecee19cc518d0322a1783424bbf3efe534f24d0def194641a5352fadb401f04b6d2d128e8fdbe9a3be757f8b456003f61e46c815a5bd9671cf6e9de30375a2

Download Submit