171cb47b401dea23d938cb685710bfe523e83c5fe763a733366882c57716ce39

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76a1a4e3bf5dd25333c6f71ed971dc38_JaffaCakes118.jad
Size

69KB
MD5

76a1a4e3bf5dd25333c6f71ed971dc38
SHA1

3187f2767a7465d3c9f66fbe87c9461a7c282b48
SHA256

171cb47b401dea23d938cb685710bfe523e83c5fe763a733366882c57716ce39
SHA512

28b88a3863296a5c64c11f39f57898bec4baa57ac92a26a1bf1fdb0c028c33f3efc8bfe0f4407ba12dbf620d627ff0c3047ccc65cdb42cefc6d21bfe686c0446
SSDEEP

1536:exY2pxBWG1vAxhEopxsOwMDXKL4U+sej5H:cVhYVfzwObU+seFH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2708	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2708	AcroRd32.exe
2708	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2328	2216	cmd.exe	29
PID 2216 wrote to memory of 2328	2216	cmd.exe	29
PID 2216 wrote to memory of 2328	2216	cmd.exe	29
PID 2328 wrote to memory of 2708	2328	rundll32.exe	30
PID 2328 wrote to memory of 2708	2328	rundll32.exe	30
PID 2328 wrote to memory of 2708	2328	rundll32.exe	30
PID 2328 wrote to memory of 2708	2328	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\76a1a4e3bf5dd25333c6f71ed971dc38_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\76a1a4e3bf5dd25333c6f71ed971dc38_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\76a1a4e3bf5dd25333c6f71ed971dc38_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4e275acb7603c74017b3bb4453a6c9e4

SHA1
6ea000f4f7e7edfb397993c093b1c6e21bbfcba2

SHA256
5d3be680aaa1929fb256686629bbf92974b6f4841e03437940112c46bf538384

SHA512
df319ee0fed481fdfb6a2f86ab122531f3a22477f09044cd61452e54fdc4dd23ab23e929a45119c7a6edcece065df1bf07d1380258f8b437f4dd02c2d59ee7a0

Download Submit