13f1bcf42e190a53cf40251dcb3177d9be7baff2100f1be562d64f93cf349984

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/03/2024, 12:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb480b36bded986ce98bd96452805ecb.jad
Size

6KB
MD5

bb480b36bded986ce98bd96452805ecb
SHA1

1e24b7256e837214f0ff02e73bbbbab905d8227f
SHA256

13f1bcf42e190a53cf40251dcb3177d9be7baff2100f1be562d64f93cf349984
SHA512

52b698b0ce46f2a58c249fb86957c34e5a80902fe7a3fdbf47acfe0aba4eba7eef8aa8f1fcbf1c58e044ede4b95351d6ab7164ab214346c22bea1704e8aa93ec
SSDEEP

192:4P/KLTtrqE6IhkPXJ8A2NqknN9tqQi7d5n4imKHE+Gv:4P/KLprx6IauAmRN9dixaimdv

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2668	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2668	AcroRd32.exe
2668	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2556	2712	cmd.exe	29
PID 2712 wrote to memory of 2556	2712	cmd.exe	29
PID 2712 wrote to memory of 2556	2712	cmd.exe	29
PID 2556 wrote to memory of 2668	2556	rundll32.exe	30
PID 2556 wrote to memory of 2668	2556	rundll32.exe	30
PID 2556 wrote to memory of 2668	2556	rundll32.exe	30
PID 2556 wrote to memory of 2668	2556	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\bb480b36bded986ce98bd96452805ecb.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\bb480b36bded986ce98bd96452805ecb.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\bb480b36bded986ce98bd96452805ecb.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
8d0f72ef89e2b7ce1766798be7b3f654

SHA1
56d6814008fc51878bfa7d0bffef1da9994aee6a

SHA256
818d39a025a74b9c03da2a1b7ffcd0639eb6cd4f668b1effaa2a8cd49ccf48b1

SHA512
d8c462d5ac6e09e93922c7d14479d5d530c63246a59a3dc3c6d6e84e12285780ffe3e591cf67ae1a61d44233429c36846368fe89c15e9fe4c04ed1e6f580e745

Download Submit