5f055b6b565c0609fe6601db897940ad85c3c469dad6470c7e7b54b90b757a21

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 23:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll
Size

73KB
MD5

f4851a9b321c5cc06594246c43006c2c
SHA1

c7e9b2a49f12fb86edd51bd41f4fdb1ff525843b
SHA256

5f055b6b565c0609fe6601db897940ad85c3c469dad6470c7e7b54b90b757a21
SHA512

8619560c1bd2cb5033847a0ae92809fbaa86d658a3176814abd7bc47902cf86629eb42fe1e7c12ab05b94c5887b86f74ce805502136f678316d37b6737fae3af
SSDEEP

1536:hO0s6t9laAGclKen/jFnToIfHTRzr5JBAZeiFp0zA+V/R8:c0s6tien/jtTBfHTRzr5JBAZeiP0Z

Score

8^/10

persistence

Malware Config

Signatures

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MediaSerial\Parameters\ServiceDll	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28
PID 1948 wrote to memory of 1508	1948	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f4851a9b321c5cc06594246c43006c2c_JaffaCakes118.dll,#1
  2⤵
  - Sets DLL path for service in the registry
  PID:1508

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:1736

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k krnlsrvc
1⤵
PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads