8bcbfe431e391336fe6a81580c1efb0d3877599c9bd31f4cc493328f8e29a2b6

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
27-02-2024 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a99e57e00adb2cb8e112cc9136572b04.jad
Size

571KB
MD5

a99e57e00adb2cb8e112cc9136572b04
SHA1

40d8dff0b02466a2a7d299cfe4c979162eb5238f
SHA256

8bcbfe431e391336fe6a81580c1efb0d3877599c9bd31f4cc493328f8e29a2b6
SHA512

a5b34007063864823ae11f22fb0f52e25a4967050df8e9d3cad5ec7805a1e751f0271a22aa7c8841f664ef29bbc5d00da9b3349bd25dc310f7146c2231828e87
SSDEEP

12288:giXu6x3bRJNk7aqwr0idJ4d/VxbJnx6pNltDgKH/:gYN9mzs8d/VxJnyNb/

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2552	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2552	AcroRd32.exe
2552	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2680	2860	cmd.exe	29
PID 2860 wrote to memory of 2680	2860	cmd.exe	29
PID 2860 wrote to memory of 2680	2860	cmd.exe	29
PID 2680 wrote to memory of 2552	2680	rundll32.exe	30
PID 2680 wrote to memory of 2552	2680	rundll32.exe	30
PID 2680 wrote to memory of 2552	2680	rundll32.exe	30
PID 2680 wrote to memory of 2552	2680	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\a99e57e00adb2cb8e112cc9136572b04.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a99e57e00adb2cb8e112cc9136572b04.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a99e57e00adb2cb8e112cc9136572b04.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e604c9fe012cf062c549e52f595d3bc1

SHA1
e1a6421419c246c599e75df61609c14938bdfb08

SHA256
fae53681beee98184795ce47756593500d3c3dc308e6d8f3cbc38c5a6974aeff

SHA512
52926ce048bd0d7512a0abdcb6ac92c6683080c1c1781da68f7894760edd6179f6d3b425452baeb22036453913189e7475320b3bed8f643f6ffb9fe04bf5fe62

Download Submit