f0b4b60d127a7febae144cc266bc3c9ce7a04c219ebb949a5cba1bf3ade3a1ba

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

索爱k790系列/Micat.jad
Size

4KB
MD5

0791c630eb98c1aa426196ea43ea0583
SHA1

62d9bd055746825cce2c7e798f258519d72bbcd6
SHA256

43662982349334276e6cb2458f04c2c739cf36facb49a0c199396ccfd87aa94a
SHA512

c03af147f47e98a80dea2db6a3f5ef2b5433eac5d9079ae14dff196ca186109d311af7fcc48f29d140f0d86712011db465eec8ed16d23312901e33825dd5c8e8
SSDEEP

96:Wk08mo30FIgDFwIJ9armT0DA8SFwIb34/bKVU21fnXCvNjsyR:uNOgDFwIJ9armgDA8SFwIb3wbKDFup

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2588	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2588	AcroRd32.exe
2588	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2560	2964	cmd.exe	29
PID 2964 wrote to memory of 2560	2964	cmd.exe	29
PID 2964 wrote to memory of 2560	2964	cmd.exe	29
PID 2560 wrote to memory of 2588	2560	rundll32.exe	30
PID 2560 wrote to memory of 2588	2560	rundll32.exe	30
PID 2560 wrote to memory of 2588	2560	rundll32.exe	30
PID 2560 wrote to memory of 2588	2560	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\索爱k790系列\Micat.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\索爱k790系列\Micat.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\索爱k790系列\Micat.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
21e1b4e6be1432bb19f0f9bc4a4a8768

SHA1
91fbc94c9716cec59fbfb6a44500c8e40b0f0b97

SHA256
46ba229d3289144ebdd1c8ce96b831f189e759789ad3907c0168287dc2e12c9c

SHA512
6e214e6d2121bb831617f74f1eb0ce7c6b4852b3a7383c1b19305f49f821cf53826405835f8d5d35e82bc05c1a3e70c37f2f744cc7e0036946910f9f46c64a61

Download Submit