33bd9dbfb553535d933ef884ed57784e1c1e9ce90bd81f1acc66800c18d992ae

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/01/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

675633102d730fb9eb01350afd84fbd6.jad
Size

35KB
MD5

675633102d730fb9eb01350afd84fbd6
SHA1

2ba94513ab21a2af615316e4588c663dfae1c090
SHA256

33bd9dbfb553535d933ef884ed57784e1c1e9ce90bd81f1acc66800c18d992ae
SHA512

03abae6b3cd245b4e0b3b708ff011744d601909ca737c6b35333f85a170dfc76976d2c6ace183d3e93d995ece5f5a6915f32005a5210a15cce22ed99863b657d
SSDEEP

768:Jde/L3ZD8mGcrgTPtr6bd0Urit3wF9+V7d7FoTFDW3yhZ3yhnJ:vcx+3TJ6qUrk79aZGyhVyhJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 1900	2732	cmd.exe	29
PID 2732 wrote to memory of 1900	2732	cmd.exe	29
PID 2732 wrote to memory of 1900	2732	cmd.exe	29
PID 1900 wrote to memory of 2680	1900	rundll32.exe	30
PID 1900 wrote to memory of 2680	1900	rundll32.exe	30
PID 1900 wrote to memory of 2680	1900	rundll32.exe	30
PID 1900 wrote to memory of 2680	1900	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\675633102d730fb9eb01350afd84fbd6.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\675633102d730fb9eb01350afd84fbd6.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1900
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\675633102d730fb9eb01350afd84fbd6.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
eee26311c800281bd3e7f7bba09756e9

SHA1
084068496cafcc3859c70b7ea073ba7200df830d

SHA256
7d95e210247106a3f48451eae75da017161ab61c51ac9de5b62c81a373ad8085

SHA512
77eb64995ce7bd430de296e690dfd6339881b3856cb2b67f3b4b9abce8f9df3694bd4e5ed004acc6935af32c2be373c9c3b4a460c089b59440a7c6e3dce8210c

Download Submit