Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 18:52
Static task
static1
Behavioral task
behavioral1
Sample
684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad
Resource
win10v2004-20240508-en
General
-
Target
684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad
-
Size
71KB
-
MD5
684494968f7d9d82f2ac2990a6b54cdf
-
SHA1
2061234f70b2510535526119004dda50f6b411b6
-
SHA256
918739471dd53480bb9362f5c9f64fc41ca0c039601f80068302b76c0db60fe8
-
SHA512
02112e5013a3d47940c0f4fea1fb90da493ddb2055716b2bede304968f9b7648e5ada0fdeff1521129ff808e2c9c34ba2af5250aff0808a851365b9b2d026b96
-
SSDEEP
1536:exY2pxBWG1vAxhEopdqB5p+mkE4WJVXYsej5B:cVhYVEH5v4WJJYseFB
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
Processes:
rundll32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
AcroRd32.exepid process 2716 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
AcroRd32.exepid process 2716 AcroRd32.exe 2716 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
cmd.exerundll32.exedescription pid process target process PID 1784 wrote to memory of 2704 1784 cmd.exe rundll32.exe PID 1784 wrote to memory of 2704 1784 cmd.exe rundll32.exe PID 1784 wrote to memory of 2704 1784 cmd.exe rundll32.exe PID 2704 wrote to memory of 2716 2704 rundll32.exe AcroRd32.exe PID 2704 wrote to memory of 2716 2704 rundll32.exe AcroRd32.exe PID 2704 wrote to memory of 2716 2704 rundll32.exe AcroRd32.exe PID 2704 wrote to memory of 2716 2704 rundll32.exe AcroRd32.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\684494968f7d9d82f2ac2990a6b54cdf_JaffaCakes118.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEventsFilesize
3KB
MD5263f40dff8e767625b95b6ec79532cb2
SHA1ca85aeedd58c7b6e0a16980cdaa99cbb5830422b
SHA2562df12c9edd9034dd9b8b53d7fec412358ba01dab29152c18e510a501ef5b95d6
SHA5128992c21b1c0ed29d7f2a03c8462ea1bbf665649cf88f1e29fd09893d28c2750ce78699879ad2a754f3932ac26be847bdea71bb74bcc135cd7d24f94e51e14ff7