934954e9cc56855cfb70ad519d301c4f36b60bc7d7d9f2da26dc9d1f670299af

Analysis

max time kernel
242s
max time network
289s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 02:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c5251bafdde3ce7f04adde8ddce27a7.jad
Size

216KB
MD5

0c5251bafdde3ce7f04adde8ddce27a7
SHA1

085191beba445108f8e03f9cf1fc5842de6e3de8
SHA256

934954e9cc56855cfb70ad519d301c4f36b60bc7d7d9f2da26dc9d1f670299af
SHA512

637aa4d97560f56c2d2e8648431775b39ba3c878b75687ae0e5d37c76857a1dd39f19092d18cc5aa4ec2b8fdb26937f09031ff785eaddfa08aa28e71ee9b7774
SSDEEP

6144:ee1skLsXjJlB1/iFy9NU46GaT1u9Q8lz+q0DFFyMm:Vsgcj9ZiFy9l6e28YqYFFm

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1664	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1664	AcroRd32.exe
1664	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 1040	1840	cmd.exe	28
PID 1840 wrote to memory of 1040	1840	cmd.exe	28
PID 1840 wrote to memory of 1040	1840	cmd.exe	28
PID 1040 wrote to memory of 1664	1040	rundll32.exe	29
PID 1040 wrote to memory of 1664	1040	rundll32.exe	29
PID 1040 wrote to memory of 1664	1040	rundll32.exe	29
PID 1040 wrote to memory of 1664	1040	rundll32.exe	29

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\0c5251bafdde3ce7f04adde8ddce27a7.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\0c5251bafdde3ce7f04adde8ddce27a7.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0c5251bafdde3ce7f04adde8ddce27a7.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8ad1ecd1e867571b2b9fcd665363c555

SHA1
d244477e37e77c455536ed971699aed99e30c5e7

SHA256
50a63f478ada87d0f9f39c6e95cef5f7d29c585de02056e733a5d7cd754c53a0

SHA512
7843a9a28eb1f0075f4a9e83348ccaee27a60b7a04d8efe42779256fea69868c83f3d1718c7988904bcd3b93907e2df58bcf004b7d408b7cae59b3e4a44b2525

Download Submit