f15827845095e2aea353de099873c9897eaccf7ec09213a8a5a1ed0f1918b3d0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4ed473e1376dd89658ff3984a208581_JaffaCakes118.jad
Size

68KB
MD5

b4ed473e1376dd89658ff3984a208581
SHA1

61fbaa6acb74cdde982094a00ab02d4d41a15514
SHA256

f15827845095e2aea353de099873c9897eaccf7ec09213a8a5a1ed0f1918b3d0
SHA512

15a07ad069ff523622edf751aebf2c4caedd9fbba3dbb8c419c06675ad33cbe25951698fc69431b073fa4879cd37d0b281c4b55ed68cb347bfe988f676174b3d
SSDEEP

1536:EjUcFC+MEcEwy7GtW2insgvrGoZNGtW2insgvrGoZM:EjUctoY7ZsArG8ZsArGX

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2748	AcroRd32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2748	AcroRd32.exe
2748	AcroRd32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1976	2976	cmd.exe	31
PID 2976 wrote to memory of 1976	2976	cmd.exe	31
PID 2976 wrote to memory of 1976	2976	cmd.exe	31
PID 1976 wrote to memory of 2748	1976	rundll32.exe	33
PID 1976 wrote to memory of 2748	1976	rundll32.exe	33
PID 1976 wrote to memory of 2748	1976	rundll32.exe	33
PID 1976 wrote to memory of 2748	1976	rundll32.exe	33

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\b4ed473e1376dd89658ff3984a208581_JaffaCakes118.jad
1⤵
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\b4ed473e1376dd89658ff3984a208581_JaffaCakes118.jad
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1976
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\b4ed473e1376dd89658ff3984a208581_JaffaCakes118.jad"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
4f852f8b72dc0dee490a37d7b9683cef

SHA1
7ba6dbf2cb814859109ec6efd643eaa60cae557c

SHA256
c08a8e88a243b25f4a729ef7f968dab8834dd513d7e90a78db002fbdc328b254

SHA512
907d1924f046de315fbbe71de8c0419698d7b4d0f60936120f81c4e3d75ffc84bb6819c167dc4878d429aec31085787b8bfefdd6f2d561f9d98ca5f475ebdc75

Download Submit