5b7e814b64d40695697a686b6e70dde6a88bf1dfb659ab7fa77128160ed10dc5

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f017211f9a04b197312114f6b425d498_JaffaCakes118.jad
Size

433KB
MD5

f017211f9a04b197312114f6b425d498
SHA1

9e7aadeb00a78186b090f433ae09e55cc3371aa2
SHA256

5b7e814b64d40695697a686b6e70dde6a88bf1dfb659ab7fa77128160ed10dc5
SHA512

fc731caae63aee8e870de334b0f77eb1c20d473d339586f85ab7390b4a1b8483f643a2b5ab6875f8e092a14b56aea016a909825835a931d11fdc82972ba9ebcc
SSDEEP

6144:ZWkpO2vTB0VvnbtkVfmSoOcSVwNwQJtaTN5bAcYvL+E0Z1xOrypDNtBUtgvDBYwQ:g2yvxJSdw9SiLj81brLZBBjMWVuK0

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1972	AcroRd32.exe
1972	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 2600	2132	cmd.exe	29
PID 2132 wrote to memory of 2600	2132	cmd.exe	29
PID 2132 wrote to memory of 2600	2132	cmd.exe	29
PID 2600 wrote to memory of 1972	2600	rundll32.exe	30
PID 2600 wrote to memory of 1972	2600	rundll32.exe	30
PID 2600 wrote to memory of 1972	2600	rundll32.exe	30
PID 2600 wrote to memory of 1972	2600	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f017211f9a04b197312114f6b425d498_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\f017211f9a04b197312114f6b425d498_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2600
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f017211f9a04b197312114f6b425d498_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
2665e481702ab5d2ddaf66790fb59134

SHA1
265b4d1fa12d1c43dbb4d28888a0e975c4df858e

SHA256
7397002bdc67768006ac4fc20f5c506310a1206d1bb2b8c35639d1d28b35094c

SHA512
f57805a81506b287490ea8fdf9dd14a9b330c8eee9d80877736cd8c7d5a95b14139e99a8f5960a3f3dd4ec2eb34cde7d498f5746d85d8d5f37be9a0e15c9e604

Download Submit