5bac77f0f5ee69e397de1b5cb2570edae306ab85766561b91a02df9d3df06d7b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
15/05/2024, 23:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

489d68e0db8aa329f6b1a80606621327_JaffaCakes118.jad
Size

69KB
MD5

489d68e0db8aa329f6b1a80606621327
SHA1

fae5c28fa2ece67c7d980dee9a19674610bcf168
SHA256

5bac77f0f5ee69e397de1b5cb2570edae306ab85766561b91a02df9d3df06d7b
SHA512

61f867d5ceab535189fc7d50b472b840330472742b93bcc8da71439d81a87eec42d28e1a6d68835dfefadd48f0ce0d31f47cb56865c15eb6a0f8662e23337296
SSDEEP

1536:exY2pxBWG1vAxhEoplvsvycz/Vxwisej54x:cVhYVDbcz/DwiseF4x

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\jad_auto_file	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2616	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2616	AcroRd32.exe
2616	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3044 wrote to memory of 2596	3044	cmd.exe	29
PID 3044 wrote to memory of 2596	3044	cmd.exe	29
PID 3044 wrote to memory of 2596	3044	cmd.exe	29
PID 2596 wrote to memory of 2616	2596	rundll32.exe	30
PID 2596 wrote to memory of 2616	2596	rundll32.exe	30
PID 2596 wrote to memory of 2616	2596	rundll32.exe	30
PID 2596 wrote to memory of 2616	2596	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\489d68e0db8aa329f6b1a80606621327_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:3044
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\489d68e0db8aa329f6b1a80606621327_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2596
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\489d68e0db8aa329f6b1a80606621327_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
d8ec070e3b8b15ed897d6bbd59d60641

SHA1
042bd42731cb321dba9788ce929c6a8dc64ca3ab

SHA256
88790d5c94342f111e3a38d9a7109254124369c8909f57529ec8036b61893dd0

SHA512
d6b812c93e40c03f6ee94fdbe21cb8e58d3ac9d845182aaf4ce58f1a16e6e35ab9d24ad4c86c8e6a940cc0eb3ca8e038e398e67401a3e5304680fed8d21de2a3

Download Submit