44e0be43e5de25004128707b2e0394d3720777667f33de72066ab2b1cbf87e95

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec3ac9cb847721a87b4b9aa6a1d3c1e1_JaffaCakes118.jad
Size

68KB
MD5

ec3ac9cb847721a87b4b9aa6a1d3c1e1
SHA1

603b1f0351a768fa0d139c765c1f7c97817f40fe
SHA256

44e0be43e5de25004128707b2e0394d3720777667f33de72066ab2b1cbf87e95
SHA512

2f50f93253073eaf88ae29f62e006a6c8e383901b20b0042e6b52bcc1eebd6a113a17b5c43b59f604cad2b48a08c1ffa08c27e9ed55def8bcabc2c0a1bbf0397
SSDEEP

1536:EjUcFC+MEcBwy7GtW2insgvrGoZNGtW2insgvrGoZJ:EjUctof7ZsArG8ZsArGO

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\jad_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2796	AcroRd32.exe
2796	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2564	2160	cmd.exe	29
PID 2160 wrote to memory of 2564	2160	cmd.exe	29
PID 2160 wrote to memory of 2564	2160	cmd.exe	29
PID 2564 wrote to memory of 2796	2564	rundll32.exe	30
PID 2564 wrote to memory of 2796	2564	rundll32.exe	30
PID 2564 wrote to memory of 2796	2564	rundll32.exe	30
PID 2564 wrote to memory of 2796	2564	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ec3ac9cb847721a87b4b9aa6a1d3c1e1_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\ec3ac9cb847721a87b4b9aa6a1d3c1e1_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ec3ac9cb847721a87b4b9aa6a1d3c1e1_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
badd22d1eb471c94210fd8abffc1cfca

SHA1
71a8bfafd716d89bbb9756127e95a1b3bdca0477

SHA256
761f9a27fdbf92deb77ccdd8f5a6f917f4ba8ef97e3d2cb6dea35fb85c926db2

SHA512
16f803f18fff74d3dfd4ce5fbaa8d1b2c90246bb8238f40c328a71c356f91371d947777d8b5bb5730dc70ca92a740e683cb9be5ef52e24739d20ec5a77a12f3e

Download Submit