936d494a7d94756cb3424bf6df0a0145199ece2e766e664b5529332f82d1e96a

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 05:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8330e9b2f21e06480dd7eaa68be06d4b_JaffaCakes118.jad
Size 69KB
Sample240530-gdt77ahe49
SHA256 936d494a7d94756cb3424bf6df0a0145199ece2e766e664b5529332f82d1e96a
MD5 8330e9b2f21e06480dd7eaa68be06d4b
SHA1 1d57b3ab6279c1e7c84168e283ac4c8034f76e81
SHA512 ce2c4519cae3c9b4fdba17313cf21ab0e75e3dfc7395c612ab7ced20c0aa20b90df88b6b6258a1f4f08ca2fa7663cc6c9ed364e667f60535692454b3e5acc4da
SSDEEP 1536:exY2pxBWG1vAxhEop+sIfOQE4EQuEsej5k:cVhYVgbfOQgQuEseFk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2644	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2644	AcroRd32.exe
2644	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 2648	2848	cmd.exe	29
PID 2848 wrote to memory of 2648	2848	cmd.exe	29
PID 2848 wrote to memory of 2648	2848	cmd.exe	29
PID 2648 wrote to memory of 2644	2648	rundll32.exe	30
PID 2648 wrote to memory of 2644	2648	rundll32.exe	30
PID 2648 wrote to memory of 2644	2648	rundll32.exe	30
PID 2648 wrote to memory of 2644	2648	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8330e9b2f21e06480dd7eaa68be06d4b_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\8330e9b2f21e06480dd7eaa68be06d4b_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2648
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8330e9b2f21e06480dd7eaa68be06d4b_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SharedDataEvents

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents
Size 3KB
SHA256 4ac705dddf7057df6b71b41564c3e67c2d944dbf64c566a0d07ec770ddd7d3b8
MD5 f8cf7be66fd7d44aa79fac7e5c85aa86
SHA1 3e7d95210ebe11bbc7fac5ba05197252c3af78c2
SHA512 6763c33f4f541ae31072ea74f8e1382d3be2c890d0b3e8e57f5eecce81648e9c3f682d5e027e131ce8f4ca608deebe53adaa744ad00480ac951082c4e3df3ba3
MD5 SHA1 SHA512

Submit Download