34ca94b94c2adca6eed2617145ef5a1b132d7b800b9982dc68978c276c295b68

Analysis

max time kernel
0s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 07:34

Target

12470a04710987857c2b03d29910a372.jad
Size

6KB
MD5

12470a04710987857c2b03d29910a372
SHA1

5ac6985cda9abb6a949678b2a19e845c7798bb26
SHA256

34ca94b94c2adca6eed2617145ef5a1b132d7b800b9982dc68978c276c295b68
SHA512

45c77469c6b02ae188e310b42cdb31029792be414230a530b5d3503834ca00ec1e3c050a5a454d20d6cf71796bcae368515d77581daa891c9cfa5da1f80c1a8e
SSDEEP

192:6vKLTtrqE6IhkPXJ8A2NqkBN9tqQY7d5n4izKHE+GQ:6vKLprx6IauAm3N9dYxaizdQ

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 2660	1788	cmd.exe	17
PID 1788 wrote to memory of 2660	1788	cmd.exe	17
PID 1788 wrote to memory of 2660	1788	cmd.exe	17

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\12470a04710987857c2b03d29910a372.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\12470a04710987857c2b03d29910a372.jad
  2⤵
  PID:2660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\12470a04710987857c2b03d29910a372.jad"
    3⤵
    PID:2696

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact