512c503d8d0ceb0ac2b7de6faa0106dc73fbc768f8e9c60aa8800662d472c6c2

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
17/05/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f5c38bdda4f47df4622aae367d835e7_JaffaCakes118.jad
Size

68KB
MD5

4f5c38bdda4f47df4622aae367d835e7
SHA1

84149b019afff5de1359ea1bc829acfe80a5934c
SHA256

512c503d8d0ceb0ac2b7de6faa0106dc73fbc768f8e9c60aa8800662d472c6c2
SHA512

137832473bb038d8fcf0310fc411685d012a186b61f9d44141a8da124c2406267a0b9452486c29348465febe34301fe43c8981f23ba6b9f1acf3eedfd9226aa2
SSDEEP

1536:exY2pxBWG1vAxhEopJ5iVc3PecU3yzsej5L6t:cVhYV75iHcrzseFLe

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2744	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2744	AcroRd32.exe
2744	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 2720	2980	cmd.exe	29
PID 2980 wrote to memory of 2720	2980	cmd.exe	29
PID 2980 wrote to memory of 2720	2980	cmd.exe	29
PID 2720 wrote to memory of 2744	2720	rundll32.exe	30
PID 2720 wrote to memory of 2744	2720	rundll32.exe	30
PID 2720 wrote to memory of 2744	2720	rundll32.exe	30
PID 2720 wrote to memory of 2744	2720	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\4f5c38bdda4f47df4622aae367d835e7_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\4f5c38bdda4f47df4622aae367d835e7_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4f5c38bdda4f47df4622aae367d835e7_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f9c1ed165af415e2b10ed0864a8624de

SHA1
5e408edc6c0eb6571d1e221c5d6c971a90439383

SHA256
bf17d258c41a3d695a01f7b8d794c23447713ac371c1f1c8cec60d047aa243e6

SHA512
dae5afc5dbba5bc934c165ccbc83601a09839ad98f73064ef62210d0c6b3ebbff62de5df6bc8c05594266baf23d40da14f48c6f2f0150353c0e8d4faa8f4ee11

Download Submit