efc8b1fec11b99419251a24c835acf7f445e4ae98eaf8bc1ab43a219d08494a6

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 14:25

Target

e2bcedf75035d93ddfd2b4a971930f91_JaffaCakes118.dll
Size

6KB
MD5

e2bcedf75035d93ddfd2b4a971930f91
SHA1

31dae9c9a92b4a71a8680384c78ec0a6bc2f2ff9
SHA256

efc8b1fec11b99419251a24c835acf7f445e4ae98eaf8bc1ab43a219d08494a6
SHA512

c936be029fac7841c4f8a90522f6c989d32b432c7175615f679f721dea63edb11a1d99dbdbbbccd4ecdcd2da3b1f6bf8cc6555c939f50f842b247646bd9a38f0
SSDEEP

96:2WiALnVPMOrjGKG3ljAvWC61WnV+VIxMvPcLMaHrN9XCtm2vNqE1WG5eRz:biAjhMOXW3l0vdV+VIxMvPKLN9Wm2vN4

Score

4^/10

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\services.exe	rundll32.exe
File opened for modification	C:\WINDOWS\services.exe	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.file	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.file\Shell	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.file\Shell\open	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.file\Shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.file\Shell\open\command\ = "C:\\WINDOWS\\services.exe baidubar,bmp"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28
PID 2180 wrote to memory of 2076	2180	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2bcedf75035d93ddfd2b4a971930f91_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\e2bcedf75035d93ddfd2b4a971930f91_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  PID:2076

memory/2076-0-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download
memory/2076-1-0x0000000010000000-0x0000000010009000-memory.dmp

Filesize
36KB

Download