6d0e9c0ed341cae622ed36d578199a66c03c4bc80763e6bafc5c99b539997304

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08-05-2024 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254bb62301af644ab8e89a1ff66584ed_JaffaCakes118.jad
Size

70KB
MD5

254bb62301af644ab8e89a1ff66584ed
SHA1

68c43fb1704aad4aef0a84b47d27dde2b3628856
SHA256

6d0e9c0ed341cae622ed36d578199a66c03c4bc80763e6bafc5c99b539997304
SHA512

aaccf41def945cc9f89315a04e11524ded6581f680d5e1420d69e944c583843610e496ea200822a39ab500bfb8f3c3ee398b540e5320620b8f7b0cc611e5fa0c
SSDEEP

1536:exY2pxBWG1vAxhEopOTX1zNVHJTtWsej5f:cVhYVgFzNJJBWseFf

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2572	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2572	AcroRd32.exe
2572	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2592	2336	cmd.exe	29
PID 2336 wrote to memory of 2592	2336	cmd.exe	29
PID 2336 wrote to memory of 2592	2336	cmd.exe	29
PID 2592 wrote to memory of 2572	2592	rundll32.exe	30
PID 2592 wrote to memory of 2572	2592	rundll32.exe	30
PID 2592 wrote to memory of 2572	2592	rundll32.exe	30
PID 2592 wrote to memory of 2572	2592	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\254bb62301af644ab8e89a1ff66584ed_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\254bb62301af644ab8e89a1ff66584ed_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\254bb62301af644ab8e89a1ff66584ed_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
145b6283c7fea94b0ca78c213372d4f9

SHA1
a0cd69d94c7b87965344273f5fc849c2062999ed

SHA256
1c731e4fbf534504eb53025c78c60f32b49b5688cdc19a95dfe9de6c200078bf

SHA512
33ca68331360702b4fa23d9f02eb3a9f0ac50f0a68188bac57520182451209a2ec566cc8967ea33d5c933e89edecaa32cf2880664d6d0968eae922ba0a09c01b

Download Submit