46ccd33e20f4a1acc4b242465a24502393eb11bd6491c80bddecc07c46881dcd

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

49db4181a28d542436b136549ff6df38_JaffaCakes118.jad
Size

68KB
MD5

49db4181a28d542436b136549ff6df38
SHA1

425114227f43ecbdff6930f5d32b90818b7458b9
SHA256

46ccd33e20f4a1acc4b242465a24502393eb11bd6491c80bddecc07c46881dcd
SHA512

2ae6e030471113321a2f727c057b29406c209985adf4ebec3b963b6d55f4d274479f4f1c518bafec31f871754e228afca7cbdb6741fd28a651a7afe08635c2d6
SSDEEP

768:AVxA92YZUeY5A76pWG9zvyti4dPQq1dUqr71pEIpT6bNSNAhtiVbH+/a1+pJsAX5:exY2pxBWG1vAxhEop2eJ7+HHsej5ss

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\jad_auto_file\shell	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2592	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2592	AcroRd32.exe
2592	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 3068	1200	cmd.exe	29
PID 1200 wrote to memory of 3068	1200	cmd.exe	29
PID 1200 wrote to memory of 3068	1200	cmd.exe	29
PID 3068 wrote to memory of 2592	3068	rundll32.exe	30
PID 3068 wrote to memory of 2592	3068	rundll32.exe	30
PID 3068 wrote to memory of 2592	3068	rundll32.exe	30
PID 3068 wrote to memory of 2592	3068	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\49db4181a28d542436b136549ff6df38_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\49db4181a28d542436b136549ff6df38_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\49db4181a28d542436b136549ff6df38_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f83b14d72ee7892e651b9b138204db7b

SHA1
85ab77077a8306117499ea58a8cd7537e552be63

SHA256
1b5d961c4cd624f82b1a982cdcaa055d990b9f4458e94de8312fcecc2d78bfe5

SHA512
4fc9c84ba3ea94cb6cba47c5b16484840c4c91c187146685754785859e85e6127dab42f32c7bf380bffaeb4a9fb28e196b9209eb31e1b06c6a503c02e898a03c

Download Submit