8ff26d5abc75c40e74339141bab539b01f774f237a312b1bbb7d8ebcdf275241

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/06/2024, 02:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

96f8dc7119f48d746d789662d14b2849_JaffaCakes118.jad
Size

69KB
MD5

96f8dc7119f48d746d789662d14b2849
SHA1

12891db4292d6bc673b206ae5efd9df948fd79d9
SHA256

8ff26d5abc75c40e74339141bab539b01f774f237a312b1bbb7d8ebcdf275241
SHA512

a70d5e475d2a1294c39dffeea1eb91173c844d9b9945918fa7d88c691bab43e7173f88c39526521a68bb5721988f9fc33049ac89b7784cca3055b4a6b2e2ec69
SSDEEP

768:AVxA92YZUeY5A76pWG9zvyti4dPQq1dUqr71pEgskGsj0KRj4eQd/xDVlMLfdLJ8:exY2pxBWG1vAxhEopQsoKoVlOfseD5wr

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2484	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2484	AcroRd32.exe
2484	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 2812 wrote to memory of 3056	2812	cmd.exe	29
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30
PID 3056 wrote to memory of 2484	3056	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\96f8dc7119f48d746d789662d14b2849_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\96f8dc7119f48d746d789662d14b2849_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\96f8dc7119f48d746d789662d14b2849_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
f036a6f62248bc1ef2ec24309777cccc

SHA1
8d10c650f3fba2fd7895615e352bc4e034e6d73c

SHA256
43f995c2ec30cc2af1a6a6d0907555b4994809baf745e8a89770b34c0008b2ff

SHA512
a0719e3451a85bf56c76646ceb7869a6f2f794c887be56e464f1bbf1fa2415436acb013afef7ab374feefea51299cba243cc7f6e977333d2d47b02c10d9d0d57

Download Submit