989f88b0f6c090dca6d7de90114bec3a1014712367894a08b93a904bdb962bc5

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 01:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6583ac3fe6d29c3a882b243f8b3e52e8_JaffaCakes118.jad
Size

70KB
MD5

6583ac3fe6d29c3a882b243f8b3e52e8
SHA1

607fd5ca843eefa6e30aa2116f2c6a4c654104ce
SHA256

989f88b0f6c090dca6d7de90114bec3a1014712367894a08b93a904bdb962bc5
SHA512

91f995f4f99af760dfb9bd241b9d8ee9b7791967cdfa3a165e36bcb7f5154ec12c8ca0e692a76f83c02254c16a7d92fc02fa8a8483ae5b4ea3a042f6b91260be
SSDEEP

1536:exY2pxBWG1vAxhEopuj9KusCIto+xV9qsej5X:cVhYVQBAZnqseFX

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

AcroRd32.exe

pid process

2704 AcroRd32.exe
2704 AcroRd32.exe

pid	process
2704	AcroRd32.exe

pid	process
2704	AcroRd32.exe
2704	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

cmd.exerundll32.exe

description	pid	process	target process
PID 1808 wrote to memory of 2512	1808	cmd.exe	rundll32.exe
PID 1808 wrote to memory of 2512	1808	cmd.exe	rundll32.exe
PID 1808 wrote to memory of 2512	1808	cmd.exe	rundll32.exe
PID 2512 wrote to memory of 2704	2512	rundll32.exe	AcroRd32.exe
PID 2512 wrote to memory of 2704	2512	rundll32.exe	AcroRd32.exe
PID 2512 wrote to memory of 2704	2512	rundll32.exe	AcroRd32.exe
PID 2512 wrote to memory of 2704	2512	rundll32.exe	AcroRd32.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\6583ac3fe6d29c3a882b243f8b3e52e8_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1808

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\6583ac3fe6d29c3a882b243f8b3e52e8_JaffaCakes118.jad
2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2512

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\6583ac3fe6d29c3a882b243f8b3e52e8_JaffaCakes118.jad"
3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2704

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Filesize
3KB

MD5
a6151f50a93587865b857f47ec13a77a

SHA1
a84badcf7ffb429c1f0adbcd12452d9f784c8e8a

SHA256
b7d8aedb6ec51ea430a32aa4a6b16c4e29be0b38b87e9715af9429cd1e9a3614

SHA512
8f5fca57ebb9ba0705c6a55fcf26a0048be8b2e4529cd0d90e7338fdb9c223503725e3a00e8ab240b57a30a8e3e22f0e0eef148f21de4f65cf08e75c7cae121e

Download Submit