1e994b5091d22896e3ca31dba64d344f676161d8a4edc599a5e9e9528d012ed7

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f2ff76c6dc5e7b1ba872450601b51588_JaffaCakes118.jad
Size

82KB
MD5

f2ff76c6dc5e7b1ba872450601b51588
SHA1

2ed584b0ff0e65ec0c126bab0e61a283f7d92787
SHA256

1e994b5091d22896e3ca31dba64d344f676161d8a4edc599a5e9e9528d012ed7
SHA512

be4d471c1eb90e648180ae9046300bc45d0c3726963f2a68a212684eea3ea448fd7666a4a8142d2605e14abea5510a90931223e656e7ec708affe6eceb687d0a
SSDEEP

1536:9QfXs7edG+KoEGOfcSrz/7fG8GydBkaOL4CDuwjov1LmsOW:uXs/8EcSQyPkLSWs1LmsOW

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\jad_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2556	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2556	AcroRd32.exe
2556	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2536	2268	cmd.exe	29
PID 2268 wrote to memory of 2536	2268	cmd.exe	29
PID 2268 wrote to memory of 2536	2268	cmd.exe	29
PID 2536 wrote to memory of 2556	2536	rundll32.exe	30
PID 2536 wrote to memory of 2556	2536	rundll32.exe	30
PID 2536 wrote to memory of 2556	2536	rundll32.exe	30
PID 2536 wrote to memory of 2556	2536	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\f2ff76c6dc5e7b1ba872450601b51588_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\f2ff76c6dc5e7b1ba872450601b51588_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\f2ff76c6dc5e7b1ba872450601b51588_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
a5dffc5ee34f80fd24a47e62819667bc

SHA1
e54d83b32344ae33e35976fff9af9043fb28b233

SHA256
d9bab94ae41c5962812f83b258fdbfb45441a9a9e9886dcba18cd32e796f17e8

SHA512
79e12b3dc96aa09feb59760cbf2c2bba2b49e2c61ec10bc6ad7b4102bd900618b0cea40eae0067f5770a9fb3f67012b4e6036ab7f4428725114b9e3a2c2c473f

Download Submit