5e7b7aa824d5343f4dfab71b9dc38475737d0e1a1ef1d79e4e228dc1adb4ed60

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-05-2024 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7890762099cc7e460ac3ae6ff81d0bbd_JaffaCakes118.jad
Size

69KB
MD5

7890762099cc7e460ac3ae6ff81d0bbd
SHA1

3db9061c9587b0431a7ee243d9a840bad2ffe500
SHA256

5e7b7aa824d5343f4dfab71b9dc38475737d0e1a1ef1d79e4e228dc1adb4ed60
SHA512

c13bee69ea3c9bdd65c2543e1da06084018fd5128b29c172f120028998a918ed98a157f61fd36e8213fd71f3b902aec4681717578e50091b58519463fad4c47c
SSDEEP

768:AVxA92YZUeY5A76pWG9zvyti4dPQq1dUqr71pEqsoPGs5gZsA1qkZuHCN6GbX7U4:exY2pxBWG1vAxhEopwsxA1LSp8Ssej5+

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2740	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2740	AcroRd32.exe
2740	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2672	1756	cmd.exe	29
PID 1756 wrote to memory of 2672	1756	cmd.exe	29
PID 1756 wrote to memory of 2672	1756	cmd.exe	29
PID 2672 wrote to memory of 2740	2672	rundll32.exe	30
PID 2672 wrote to memory of 2740	2672	rundll32.exe	30
PID 2672 wrote to memory of 2740	2672	rundll32.exe	30
PID 2672 wrote to memory of 2740	2672	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\7890762099cc7e460ac3ae6ff81d0bbd_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\7890762099cc7e460ac3ae6ff81d0bbd_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\7890762099cc7e460ac3ae6ff81d0bbd_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
edb6fff3611901e12a740d97ffb37b6d

SHA1
89de49f0f4595f64055ddd89cbeb9648353d74a7

SHA256
78fc651c4915c0afd224224ab8feeb8051708ae42c5b3a5b614d0ec5a2e6d8a5

SHA512
bb4fce52b7f1cfc2ee2fc978223b65a51c3ae612de936e275fe59b63f1fb452fa8c6986093bf818e1448e27169d90c1e44c84a0f36398243d4c996fdfa71a6b1

Download Submit