Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 17:19
Static task
static1
Behavioral task
behavioral1
Sample
facb1194670abea1d2e6214982d0f6d4_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
facb1194670abea1d2e6214982d0f6d4_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
facb1194670abea1d2e6214982d0f6d4_JaffaCakes118.dll
-
Size
120KB
-
MD5
facb1194670abea1d2e6214982d0f6d4
-
SHA1
2009a7d920afe52402114cd59d2e3cc02b8a8b88
-
SHA256
f80f66e6be0c2d771fa4df22a4d5a1321d12b2be6019a7957cbc77e7c9b589ec
-
SHA512
ef104405c7944b6a36a76f007bb0ac1f0c5f38b9a9a8792fa333f103db520db8faafad6eb720b7aaea339b1bc94d81b6d8c1847a4fa2a8b30d4dc66f0116294d
-
SSDEEP
3072:RNBtaKSkuUnrU82LWekCxPTO0xa46aofwKqp:R3lSkurzr/P3aOo
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 2944 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe PID 1952 wrote to memory of 2944 1952 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\facb1194670abea1d2e6214982d0f6d4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\facb1194670abea1d2e6214982d0f6d4_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses