0f9ec0d04207a91bae46f22d6135603d059bce97575dc7d1247fc0f438cbae1a

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e6560eef43e2185038395b00e418ee8_JaffaCakes118.jad
Size

71KB
MD5

3e6560eef43e2185038395b00e418ee8
SHA1

d65e00f7f767692f644a4a7c73900097f587e068
SHA256

0f9ec0d04207a91bae46f22d6135603d059bce97575dc7d1247fc0f438cbae1a
SHA512

3e5443a9cbe2b5c120a60a811aab1e376799178b410f1aa793092a09748fb01460756350280681335f1382fab4348a52784995e08d57ce7760225ec7f049628b
SSDEEP

1536:exY2pxBWG1vAxhEopKoQy5eq1sVVvkJussej5F:cVhYV8JzqaVpU5seFF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2612	2404	cmd.exe	29
PID 2404 wrote to memory of 2612	2404	cmd.exe	29
PID 2404 wrote to memory of 2612	2404	cmd.exe	29
PID 2612 wrote to memory of 2592	2612	rundll32.exe	30
PID 2612 wrote to memory of 2592	2612	rundll32.exe	30
PID 2612 wrote to memory of 2592	2612	rundll32.exe	30
PID 2612 wrote to memory of 2592	2612	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3e6560eef43e2185038395b00e418ee8_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\3e6560eef43e2185038395b00e418ee8_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3e6560eef43e2185038395b00e418ee8_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f2328f067eb840a81d9281f7033d38e

SHA1
abaadd6d351fa6a4c5bfa72dc46bf9ff2d358e04

SHA256
90c117755bc30dfad330391a140cbcfb44a126f5a9958bd8e5aeccb6b277d104

SHA512
f3bffdb1d243693648564869f73ea8d8fda00bdd53bca61f5caae69841497b33ea5d5a1ffa1b39ce824c859ba3dbd1c344b3eaed875a4734cdaea2caebbc2315

Download Submit