Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
28-03-2024 22:15
General
-
Target
1184f38a5ab591929c39dc6af3012d50_JaffaCakes118.dll
-
Size
383KB
-
MD5
1184f38a5ab591929c39dc6af3012d50
-
SHA1
28d5e8bcfa8967ec69265fd851f948e185c541de
-
SHA256
ae3de70319b20534d219ae86900c2d54498b91078f76aa4f1a86c6cdb12e6cc9
-
SHA512
1d89eff0e925426e0deaa312c86e6286fcd6ea8e820caab1dbba8e3fdd43d66029e9b4df18115b5cbdb37f227c14ec1eda658ecc97b1539fbfc654ce23817263
-
SSDEEP
6144:IRD4MlqMABEN37jt9ZA3H8DaLCw0w6LhMA8aF8pVqEDFqf1b/3C:IRZQOrcHwwH6tMzaFg8EDcf1r3C
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 3 IoCs
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 44 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1184f38a5ab591929c39dc6af3012d50_JaffaCakes118.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpkinstall.exeC:\Windows\system32\lpkinstall.exe1⤵
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\qeHAN2.cmd1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6951e91e-6b9e-1a22-c633-d33824079498}"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Delete /F /TN "User_Feed_Synchronization-{6951e91e-6b9e-1a22-c633-d33824079498}"2⤵
-
-
C:\Windows\system32\MDMAgent.exeC:\Windows\system32\MDMAgent.exe1⤵
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Cvz.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\eventvwr.msc"2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
194B
MD5673e410d626b89d5171244a43c2f9d16
SHA105fd3730f0b16bdc20aec186b4a50e2f91ee9e42
SHA2566c60fd4056b8c1a45469b792eeb633e66da3b0c8d1408c162b3adefda8e0f856
SHA512414ff67eaa43b520cb552f1de5a177102e250f7b0618c381299548c8b87bccdb1e503dd5e0a4ec4782f993a87933dd3840c0473ae681bf7e1a57490386c8ba7b
-
Filesize
384KB
MD59486e414add9d77ecb52e859fc79885c
SHA14953a6ff6578a504af830477c0dd6930cc0deb80
SHA256e10550ef7b7dd9c9f1bcfe856190e50f313a96f2605c61d5caeaf8408b1cbf8f
SHA512b27391cfa19a2fd5b6613bacc3b9f0cf96dc230e001ac3c11092275c041624318daeec08562b163e37ac474aa5f23632284cb928e7e576cda7f8083418a3aec4
-
Filesize
386KB
MD52f8eec17005e767e3092d23f8472c894
SHA1e701bf4eb3846d184be7a03d0d2ab159597721f4
SHA2563d3f54b18ef7ec24e3ac736f32618928284694fc7d7a10c909f035b3e04fd9ee
SHA512e02ac55f5c0291702c5f9e20be8d7c2a1caa04b5b00431acc5a227ba485dfc514852c8f2e8cde447c16dff5596b1fbb099fbf744aa59caf4a444c95e1a60006b
-
Filesize
232B
MD526ce47bd9dcc7db2c5fe46ab65e164ab
SHA13b6cc6887f274ad2349c0b8a59bd5cce674defbc
SHA256187860300a50d86a567673ddb0e788492751098de375aa636979c9c32b958442
SHA512945fd2b241095340c9c600a3d35ef4a9a1d38ae23e7ee0e784a73b1841939a7d2b97a11b069b5dcb20560f8829d45d7fd9c28cf9c6f152b669a9f27de0fc7223
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
922B
MD59a9efb0a4b8de820a3ac47c807bddd90
SHA17749ee9b0c8273aa2072c7ddce4de07808e710f7
SHA256f894163bc7a9ce402803ccd84e7682112f9f68e897d9d731faa3378f1cb8aeee
SHA512975a3d3eaf7a0d2e7972baf163d4e89f4b3f53f753e22aa527472da277a8737bd63c35fb42f665a58e2263626369a9dc90b46e8c3f6659d3d4280094d5b558fd
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
64KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
4KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
4KB
-
Filesize
404KB
-
Filesize
404KB
-
Filesize
12KB