639df1cf2e0989c11e3fa876ec737e011a562e69f4e989c7cb2cfd231861a930

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 01:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b618c834f8e408b40e91c1ecdd425b04_JaffaCakes118.jad
Size

58KB
MD5

b618c834f8e408b40e91c1ecdd425b04
SHA1

2c1de5331a48b1d2fb2f0caeb6fd667a7b7c651b
SHA256

639df1cf2e0989c11e3fa876ec737e011a562e69f4e989c7cb2cfd231861a930
SHA512

33588f2260fa03365d50a64165c4b1d14956d37c733360335552dc519fba248caa99bd036d46f6741248ba3d6cb1272a770a75695557dee6042534d7de7a46f4
SSDEEP

1536:exY2pxBWG1vAxhEoptERCPDeD8KqJGsej5F:cVhYVT/PnfGseFF

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.jad	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2772	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2772	AcroRd32.exe
2772	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 2732	2020	cmd.exe	29
PID 2020 wrote to memory of 2732	2020	cmd.exe	29
PID 2020 wrote to memory of 2732	2020	cmd.exe	29
PID 2732 wrote to memory of 2772	2732	rundll32.exe	30
PID 2732 wrote to memory of 2772	2732	rundll32.exe	30
PID 2732 wrote to memory of 2772	2732	rundll32.exe	30
PID 2732 wrote to memory of 2772	2732	rundll32.exe	30

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b618c834f8e408b40e91c1ecdd425b04_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\b618c834f8e408b40e91c1ecdd425b04_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b618c834f8e408b40e91c1ecdd425b04_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
7a5a7273d21cfd1f82fe9fe83c4e87a3

SHA1
6ec13ac549c754f6f386d6f4897aa6351e250a62

SHA256
d3aed4f9ec38409f4122e81c18fb4a5e26e3d765f8925c6c3668b74fc8e4f0ab

SHA512
e76f27f1ceba1b22bfe83202e3f7e8e0e96ede08480d76d6cc1558cf73e99896dadb042d88d3ac1185ea2f267cd0052d9d4513c8d505c651ad100e6563b93fb0

Download Submit