64a2ef05aa14eb3eaf4b1191ccad5ebf1a6367a0e89801df1ffceeb9e15baa32

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07e6f95ddf91415897164d7b3eb4736_JaffaCakes118.jad
Size

341KB
MD5

b07e6f95ddf91415897164d7b3eb4736
SHA1

cc70c71ed9e92a3169d95e4c7c3937342b165baa
SHA256

64a2ef05aa14eb3eaf4b1191ccad5ebf1a6367a0e89801df1ffceeb9e15baa32
SHA512

dcdac34c377571d83a30589a68f0cedd438c68f6f998db3ffae10b7103f42fd99599067769bf55f850b6f35cbb61aa5759fa9e086f527c758fa9e4c3a03358af
SSDEEP

6144:gZBzVsRmUXil2Uk7TO9tFqTWANztd4MKZpgi9RSt+SELmIjaHPbF:izaUzl2UIT6F0WANPKZysRSt1EXaHTF

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file\shell\Read	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file\shell\Read\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.jad	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\.jad\ = "jad_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\jad_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\""	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2812	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2812	AcroRd32.exe
2812	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2224	2052	cmd.exe	31
PID 2052 wrote to memory of 2224	2052	cmd.exe	31
PID 2052 wrote to memory of 2224	2052	cmd.exe	31
PID 2224 wrote to memory of 2812	2224	rundll32.exe	32
PID 2224 wrote to memory of 2812	2224	rundll32.exe	32
PID 2224 wrote to memory of 2812	2224	rundll32.exe	32
PID 2224 wrote to memory of 2812	2224	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b07e6f95ddf91415897164d7b3eb4736_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\b07e6f95ddf91415897164d7b3eb4736_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b07e6f95ddf91415897164d7b3eb4736_JaffaCakes118.jad"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
1f72fda6a8e67f5b33cc05deea0c5104

SHA1
c6efb7737381aa72870cbc92d5e7943aa2038188

SHA256
18c4fdccc761f50926053eb94d01131fd3a21821d34c0e32b4ff025ca0a2a84b

SHA512
aabeff627ffdcbd3099c166eba6d4907ae08aebeb3576f79fa224ead0e68354dea0254aa0166e91f94a3cd9247f05f75f990549f1819f591176c0676a4947948

Download Submit