a4ec597e7c8b640072d34970780148e8466e949d7e575293b3b76efc99479e63

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 14:16

Target

63952443011d54c9f513b0ef5166e437_JaffaCakes118.jad
Size

64KB
MD5

63952443011d54c9f513b0ef5166e437
SHA1

96f7e9d8e6f428ad40c371ae4b5c61686e5733fc
SHA256

a4ec597e7c8b640072d34970780148e8466e949d7e575293b3b76efc99479e63
SHA512

730eab6a823c186dd15b484e0781ba95d00dbd7da3f428632ab290eac119d1c1744a226f314f85e2284e7945b7533c161dae86f41420d257a72461ca7ebf0c48
SSDEEP

1536:exY2pxBWG1vAxhEop69dKsw/vbGvseL5c:cVhYVEism6vsedc

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2812 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2812 AcroRd32.exe
2812 AcroRd32.exe

pid	process
2812	AcroRd32.exe

pid	process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 2616 wrote to memory of 2732	2616	cmd.exe	rundll32.exe
PID 2616 wrote to memory of 2732	2616	cmd.exe	rundll32.exe
PID 2616 wrote to memory of 2732	2616	cmd.exe	rundll32.exe
PID 2732 wrote to memory of 2812	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2812	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2812	2732	rundll32.exe	AcroRd32.exe
PID 2732 wrote to memory of 2812	2732	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\63952443011d54c9f513b0ef5166e437_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\63952443011d54c9f513b0ef5166e437_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\63952443011d54c9f513b0ef5166e437_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
93abcacf59c56bc0f7610bbc29ae0bd8

SHA1
f9bed891a78be29b501608c850dfadaa31b33cba

SHA256
97392ae01ccd2a53fda8eb16853dcf7e9f25da27a6d6153c78c4a16cc737ba00

SHA512
a52fbe9a7a153bf4a01792fc3c3a7cc536ef08b0690aace326b006ca85277de843d525466efbb2bcd6b6c6c6de93d37b5d5a04afdcf58fa7e64b77f30c86c3e5

Download Submit