e186a6b89db7bf642da0c233fbfe581fd817b176d7bdfb16c155fb1600169fb7

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 14:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

404878f29232eaf53e106184bd727b8e_JaffaCakes118.jad
Size

68KB
MD5

404878f29232eaf53e106184bd727b8e
SHA1

be96ca327ce699239b37636126f29b91dccd51ce
SHA256

e186a6b89db7bf642da0c233fbfe581fd817b176d7bdfb16c155fb1600169fb7
SHA512

645d46c93b2a58f6905d2b54bacfff1f10d7d3b9d0d6ec2cca61fc5f0398bcfa85dee5c33567ad93fbc26d0e4d70115a86718ffd96cdb86c7afae7f49cab8aa0
SSDEEP

1536:EjUcFC+MEcowy7GtW2insgvrGoZNGtW2insgvrGoZC:EjUctok7ZsArG8ZsArGl

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2936	AcroRd32.exe
2936	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 2160 wrote to memory of 3060	2160	cmd.exe	31
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32
PID 3060 wrote to memory of 2936	3060	rundll32.exe	32

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\404878f29232eaf53e106184bd727b8e_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\404878f29232eaf53e106184bd727b8e_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\404878f29232eaf53e106184bd727b8e_JaffaCakes118.jad"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
34f0a37ca34d59fb680846b2a43499b9

SHA1
ef5aa4960aeff88762ab56839d2541ff8843c160

SHA256
e617c0d0a00447dc72f968f9d7f6c2a8dba396c128e2e3be6528778541421a76

SHA512
f5ba12383f72031e15041242cac4118aa3465483232619a04440bf374dcd516e61f930f672989fbad31d60124797063f03c3930c3139bff0bc8568dc0fbf9b43

Download Submit