2ce54622a2964a36435d34d1cc8800dacb43b980b540dac64f5636de286759ce

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19-04-2024 17:28

Target

facf889a46495eed13a59381a60cc079_JaffaCakes118.dll
Size

141KB
MD5

facf889a46495eed13a59381a60cc079
SHA1

4f8c4272f62608da534285b69b4e2b5ff74255ee
SHA256

2ce54622a2964a36435d34d1cc8800dacb43b980b540dac64f5636de286759ce
SHA512

8ad8d007d6e2df545420d7934015af1afa45dd314f651778ab45a6576cb8388aedd444ed514c9f350365c180587fab2b90c101079a314b08e284a32653754a8e
SSDEEP

3072:Eomy9OVf/YYEezo8usyBoUvYYYD3zKneQygZgC0Pgs:Eo5GYYS8usMfYYO3TcZgCEg

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 940 wrote to memory of 648	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 648	940	rundll32.exe	rundll32.exe
PID 940 wrote to memory of 648	940	rundll32.exe	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\facf889a46495eed13a59381a60cc079_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\facf889a46495eed13a59381a60cc079_JaffaCakes118.dll,#1
  2⤵
  PID:648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3996 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:4140

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/648-0-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/648-1-0x0000000000430000-0x00000000004F4000-memory.dmp

Filesize
784KB

Download
memory/648-4-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/648-7-0x0000000000430000-0x00000000004F4000-memory.dmp

Filesize
784KB

Download