ecc74b05dc928e2184dc2f74b3498ae957f34de790adb5c5d68ff3fa1fa09d00

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 04:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5563e6b2f2a715288cda2f725d34df3f_JaffaCakes118.jad
Size

68KB
MD5

5563e6b2f2a715288cda2f725d34df3f
SHA1

4d5390790f4fe81244e438dbafe467bfdcd5165c
SHA256

ecc74b05dc928e2184dc2f74b3498ae957f34de790adb5c5d68ff3fa1fa09d00
SHA512

ff1da5ec889341ca46618d5713db47cd94679a3307a34ef49533ff952076106c581e022de13cb9c80afb7961a63c6cb2f8d0bc9c261207b9b607ba96ff66fe6e
SSDEEP

1536:EjUcFC+MEc2wy7GtW2insgvrGoZNGtW2insgvrGoZp:EjUctoW7ZsArG8ZsArGq

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2888	AcroRd32.exe
2888	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1716	2148	cmd.exe	31
PID 2148 wrote to memory of 1716	2148	cmd.exe	31
PID 2148 wrote to memory of 1716	2148	cmd.exe	31
PID 1716 wrote to memory of 2888	1716	rundll32.exe	33
PID 1716 wrote to memory of 2888	1716	rundll32.exe	33
PID 1716 wrote to memory of 2888	1716	rundll32.exe	33
PID 1716 wrote to memory of 2888	1716	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5563e6b2f2a715288cda2f725d34df3f_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\5563e6b2f2a715288cda2f725d34df3f_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\5563e6b2f2a715288cda2f725d34df3f_JaffaCakes118.jad"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
622694beb10cd6f8116617a87c66f4d3

SHA1
45b17639d172781ee83e802677e4ef1c7c35fde0

SHA256
0fc393822d8368dcb4dc94f7361f13eb4e8ffe23ae473668642aaaf7403bd9e0

SHA512
e0f1a151d8df300b62369fb8752df440c0ff9de83090bf3300f1385b4cfbfe4acf025d48f161895ad6f96856c3e6074418958599c373febea9c3628294966f5b

Download Submit