Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 10:07
Static task
static1
Behavioral task
behavioral1
Sample
a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad
Resource
win10v2004-20240226-en
General
-
Target
a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad
-
Size
70KB
-
MD5
a500da063582bb7cae1f836b8f0e0b8f
-
SHA1
45fab9b1eaae3e7bd4d320a9c09bf072fa57e3bd
-
SHA256
004d4d04eda359bb2fc8aba7a04f147654bc5de2e37c78a5bc151baff09c3447
-
SHA512
50718b2ec3acbaeba9e57b369ad30382ae0ae8452c8055e7e487643f82392e21ac2347bf3f0205b713ee0cfc179e3ffeedcd3043d9dfdf8730c8c85196816c92
-
SSDEEP
1536:exY2pxBWG1vAxhEopHh1uUpWrVvWc1tAsej5s:cVhYVVuUpSZWcYseFs
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file\ rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.jad\ = "jad_auto_file" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.jad rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file\shell\Read rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file\shell rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file\shell\Read\command rundll32.exe Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" rundll32.exe Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\jad_auto_file rundll32.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2784 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2784 AcroRd32.exe 2784 AcroRd32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1168 wrote to memory of 2900 1168 cmd.exe 29 PID 1168 wrote to memory of 2900 1168 cmd.exe 29 PID 1168 wrote to memory of 2900 1168 cmd.exe 29 PID 2900 wrote to memory of 2784 2900 rundll32.exe 30 PID 2900 wrote to memory of 2784 2900 rundll32.exe 30 PID 2900 wrote to memory of 2784 2900 rundll32.exe 30 PID 2900 wrote to memory of 2784 2900 rundll32.exe 30
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\a500da063582bb7cae1f836b8f0e0b8f_JaffaCakes118.jad"3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2784
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bbc35151fb27fe031e94a863ac21363c
SHA15c74e54297e4d058d6494a719ca1439b5debf20a
SHA256b8c76252429def86229cdc2aa6cfbdc8590a2003b1210b7f70afa65bb78a46d5
SHA512e6abbd7b4aecc115f7d6d9218b9eaeca5c1da8f5df4d75707501dd843458be6a86c5a72dae4a8a9edb6f4c2f5998c2ec9303fb2626c4aae08fcad396e1370f74