d7a52760eda963169642e2b8de9f173eecc8c4f8f5cc862d6c3e0e62dd264c86

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
08/07/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ce1b1e6eb7b419844d648c0bd1fb0c6_JaffaCakes118.tar
Size

10KB
MD5

2ce1b1e6eb7b419844d648c0bd1fb0c6
SHA1

fec3c932a254531c6ba9dbf6860815e7be7c7c82
SHA256

d7a52760eda963169642e2b8de9f173eecc8c4f8f5cc862d6c3e0e62dd264c86
SHA512

274d129837249788e09ff604112504df9d233cb725106f7957e9d00c27712f7c0ff1d372cbbde787e36269a7808e3302e2031478d906bd8134e4ffccb82b8834
SSDEEP

12:Vo7965eyaksxQYlrpXnvynrbOGWTD1evbsNfSS9X:eRx5kWlInrbOGWP1ebs

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2284	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2284	AcroRd32.exe
2284	AcroRd32.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2916	2876	cmd.exe	31
PID 2876 wrote to memory of 2916	2876	cmd.exe	31
PID 2876 wrote to memory of 2916	2876	cmd.exe	31
PID 2916 wrote to memory of 2636	2916	rundll32.exe	32
PID 2916 wrote to memory of 2636	2916	rundll32.exe	32
PID 2916 wrote to memory of 2636	2916	rundll32.exe	32
PID 2636 wrote to memory of 2284	2636	rundll32.exe	34
PID 2636 wrote to memory of 2284	2636	rundll32.exe	34
PID 2636 wrote to memory of 2284	2636	rundll32.exe	34
PID 2636 wrote to memory of 2284	2636	rundll32.exe	34

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2ce1b1e6eb7b419844d648c0bd1fb0c6_JaffaCakes118.tar
1⤵
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2ce1b1e6eb7b419844d648c0bd1fb0c6_JaffaCakes118.tar
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\system32\rundll32.exe
    "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\2ce1b1e6eb7b419844d648c0bd1fb0c6_JaffaCakes118.tar
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2636
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\2ce1b1e6eb7b419844d648c0bd1fb0c6_JaffaCakes118.tar"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
9d882d5b0fb1039314c55136ed85e382

SHA1
f81d2596c71438bbab4552e669bef51ae9a26aa6

SHA256
5dcbc4321021b5cfb6195ab19270296903ba652a9dc6ec3f8577d02c73f3b20c

SHA512
4385c053da1900c83a108fb76768837460d363fc4c19e29dcf1c58069a9f2836f6dad9f22b523bb45e7957e090a6a85be70a7bdc1caf87718004811ff6b97c76

Download Submit