6c423beea04b06cc75b9bfe425331bcee41f3528764a635fbf9bc6154072c652

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31/12/2023, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2581d5c2e2db2115a2ae805bba956db0.jad
Size

10KB
MD5

2581d5c2e2db2115a2ae805bba956db0
SHA1

197f01d0ab0ac0cb68029e63cf8fc47afcb9368d
SHA256

6c423beea04b06cc75b9bfe425331bcee41f3528764a635fbf9bc6154072c652
SHA512

ded363336fe5472545e8d0192d1542e8a53ff686cbc9f9cbcba780afd24c4f95ae04fa8ffd95c4891d8f1ba52b9d04d4d03cb3f05cbe5ed777259b0532c37664
SSDEEP

192:Bo8oAoeJEPF5fBJHKQgViM1/SAoWqxhgpV1u4JMZpnta9x/QfBggCn:MzHQ1aFWqXqXJcSj0Yn

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2828	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2828	AcroRd32.exe
2828	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2664	2088	cmd.exe	29
PID 2088 wrote to memory of 2664	2088	cmd.exe	29
PID 2088 wrote to memory of 2664	2088	cmd.exe	29
PID 2664 wrote to memory of 2828	2664	rundll32.exe	30
PID 2664 wrote to memory of 2828	2664	rundll32.exe	30
PID 2664 wrote to memory of 2828	2664	rundll32.exe	30
PID 2664 wrote to memory of 2828	2664	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2581d5c2e2db2115a2ae805bba956db0.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2581d5c2e2db2115a2ae805bba956db0.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2581d5c2e2db2115a2ae805bba956db0.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8fc5cec84adf14955b48bec8816233f7

SHA1
98131982c2e8f42b92bb0971bf653abdb23e9ec2

SHA256
12adb59f595b61b04290e42193df2e6afc3e2f33fe0f0b1964ee6347d26c8768

SHA512
be760ec761b7c022a36498ad20ad0888bfe42ca392c348c06326dd017957c8956c6bc0bfc19cbbca008684f5cb87be70f54e5dcd81504b679a036b429ea2b091

Download Submit