ec7ac30d2cad4a6471e171bce3d690475eba84a98376c05f5c4f5e3b055908a5

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07-05-2024 14:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20c32e44dfa853358e9559985d4b291f_JaffaCakes118.jad
Size

67KB
MD5

20c32e44dfa853358e9559985d4b291f
SHA1

b01699b903db671747341aa6f338b765163d4250
SHA256

ec7ac30d2cad4a6471e171bce3d690475eba84a98376c05f5c4f5e3b055908a5
SHA512

49c9e29e8d035fb815e9108039911c653ae9ba051487e26be372b9dcd71ec75c5dcc633fdc156539c2f265cde573456f4c4f22ff0d872d9ecf00e747d3ca9668
SSDEEP

1536:exY2pxBWG1vAxhEopHptIUwpMRZ2seL5q:cVhYVp7LwpZsedq

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 3012	1684	cmd.exe	29
PID 1684 wrote to memory of 3012	1684	cmd.exe	29
PID 1684 wrote to memory of 3012	1684	cmd.exe	29
PID 3012 wrote to memory of 2644	3012	rundll32.exe	30
PID 3012 wrote to memory of 2644	3012	rundll32.exe	30
PID 3012 wrote to memory of 2644	3012	rundll32.exe	30
PID 3012 wrote to memory of 2644	3012	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\20c32e44dfa853358e9559985d4b291f_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\20c32e44dfa853358e9559985d4b291f_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\20c32e44dfa853358e9559985d4b291f_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9b853bb1e958107be0007555e706d980

SHA1
581f62313dc32972c84ed1a18a919b4944369b82

SHA256
f92f6d47d39e1968a3a12742037c336cabcc3d500ed6f8d9eb88aa6e180daaa5

SHA512
ba3757a7c917569ce582ecf6865eaf0c81f4bb648706f6fab70bef6dc5d9d7ed402891d5e94b763bde4aa7edeab86d100bb6635a1317128ee2e5c08db5596b28

Download Submit