a1ba2afdfa24cc00decc2b5db2466b8ad73d466bcddc39e3203d486266601d86

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/06/2024, 13:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8a91f552727d695b577e9e7d70fdb082_JaffaCakes118.jad
Size

559KB
MD5

8a91f552727d695b577e9e7d70fdb082
SHA1

62bc86e7c2fb9b328a573099fad0e4ab93ddbd42
SHA256

a1ba2afdfa24cc00decc2b5db2466b8ad73d466bcddc39e3203d486266601d86
SHA512

1c424b04cd96561f38ce1a747af0e7e3e3ba3c1849f605d10354903272effdba6ff94316a6a33f3242dc2ad15999038f086e93c99561eabbb0d370199ebcce42
SSDEEP

12288:NUpX8BwekyNN/gpSJE+tgPbWJvSkTkSHhXNORC/zlvUN6f6nYU:NUSBLR7iDMvhjj1/zFUW6d

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2672	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2672	AcroRd32.exe
2672	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2892 wrote to memory of 2640	2892	cmd.exe	29
PID 2892 wrote to memory of 2640	2892	cmd.exe	29
PID 2892 wrote to memory of 2640	2892	cmd.exe	29
PID 2640 wrote to memory of 2672	2640	rundll32.exe	30
PID 2640 wrote to memory of 2672	2640	rundll32.exe	30
PID 2640 wrote to memory of 2672	2640	rundll32.exe	30
PID 2640 wrote to memory of 2672	2640	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\8a91f552727d695b577e9e7d70fdb082_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2892
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\8a91f552727d695b577e9e7d70fdb082_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\8a91f552727d695b577e9e7d70fdb082_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7051721e045901825d2b5c34b06618fe

SHA1
bd71f6f422fed516fd0ddd707a760b8ef1dcd1ea

SHA256
4fa28186402d28d6e64a544f00abe7d5b536297a1df7d47e7b76017d924cf12d

SHA512
51b9eb7703d88f45f871ec07c3af03957804fe8a5d1de825be912cbb4bc281f445bbeb3c5a4db85c10cfeaa6887bf10205c70531d9ac85441e5224e5eded47bf

Download Submit