Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13/06/2024, 02:43
Static task
static1
Behavioral task
behavioral1
Sample
a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad
Resource
win10v2004-20240508-en
General
-
Target
a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad
-
Size
69KB
-
MD5
a39283c697092aa75fecd2398f393f87
-
SHA1
6a4e1541f49a5da2b4ff4759f0ce558764c5a18f
-
SHA256
26b6f3fca5ff1f243bd3643a8f34131dee3d1b50eb04f53e93e3a769540e556a
-
SHA512
1951298d0453672e1e6a0405dbf7a1372b1682c95dc93b49cdfd263d172427eb47b18a34fc74f671c077d1d8a9472089997ec71d258d7d435b49d3c9343544f9
-
SSDEEP
768:AVxA92YZUeY5A76pWG9zvyti4dPQq1dUqr71pERshGs63FY3uti9L/ODLxscJsAo:exY2pxBWG1vAxhEopUsR3LTOJtsej5+
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\ rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2724 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2724 AcroRd32.exe 2724 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2360 wrote to memory of 1372 2360 cmd.exe 29 PID 2360 wrote to memory of 1372 2360 cmd.exe 29 PID 2360 wrote to memory of 1372 2360 cmd.exe 29 PID 1372 wrote to memory of 2724 1372 rundll32.exe 30 PID 1372 wrote to memory of 2724 1372 rundll32.exe 30 PID 1372 wrote to memory of 2724 1372 rundll32.exe 30 PID 1372 wrote to memory of 2724 1372 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad1⤵
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a39283c697092aa75fecd2398f393f87_JaffaCakes118.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2724
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5f3eafd32723ddcb67fe7a59cd6cb4a1a
SHA1cf88ef816ef2c459be05b2b3ef7debc68f681f2c
SHA256305e023c21f51019b267196fc6713af2feaa0ae663ecfabaa720492a1bf09d4b
SHA5127e84c89ca76f34fb9cd2c2d60521f953ccb8ddd305c7f1bbb5150aa7d33c719f5bde1e3837d9a89612eeff2e1f23c955cfd57a72cb24c4f4edc50433bf0669b1