76ff315084f193ba361b038448fefa720b7ed94381ed3e7d174a05bd050b3f25

Analysis

max time kernel
103s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3eb94242789656572e5c3ab58a76feab_JaffaCakes118.jad
Size

8KB
MD5

3eb94242789656572e5c3ab58a76feab
SHA1

c37755f049cefa33d56392d05a77ea0a211fe6de
SHA256

76ff315084f193ba361b038448fefa720b7ed94381ed3e7d174a05bd050b3f25
SHA512

429af50177f818a63386895e25c92bb9afae1f7f03cc4347c215a5dbbeeaff2ffce0e564f864a5c8b5aa5b79f767789efe92657360739af1bc03369fdabcec13
SSDEEP

192:GZzNC+xI+kIyF/12QL2385L63S0tKg9E05TUMYqHp:eY0TkIyF/0sA+6dXE05XJ

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2996	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2996	AcroRd32.exe
2996	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2148	2388	cmd.exe	30
PID 2388 wrote to memory of 2148	2388	cmd.exe	30
PID 2388 wrote to memory of 2148	2388	cmd.exe	30
PID 2148 wrote to memory of 2996	2148	rundll32.exe	31
PID 2148 wrote to memory of 2996	2148	rundll32.exe	31
PID 2148 wrote to memory of 2996	2148	rundll32.exe	31
PID 2148 wrote to memory of 2996	2148	rundll32.exe	31

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\3eb94242789656572e5c3ab58a76feab_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\3eb94242789656572e5c3ab58a76feab_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\3eb94242789656572e5c3ab58a76feab_JaffaCakes118.jad"
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
e5d7142abf2783f1390ebebc29a080bf

SHA1
6348a507885adf5abaa02a972dcde46e1dbe72d3

SHA256
046624cedb2b1a6049e5b7aca3660731ae2282e135aa0ca5ec6893ae74f1fece

SHA512
69b612971a0110fe883781115ad557a14cf0d6f799da7c7bf6b9514432bec8a96ea21a293d67c4333e471cfee8f455377fd4b33b946e749049a6dcf41b5c3b81

Download Submit