Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-04-2024 19:44
Static task
static1
Behavioral task
behavioral1
Sample
fb08fa2dbb00f4aa868eaa93c0603e55_JaffaCakes118.dll
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fb08fa2dbb00f4aa868eaa93c0603e55_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
fb08fa2dbb00f4aa868eaa93c0603e55_JaffaCakes118.dll
-
Size
262KB
-
MD5
fb08fa2dbb00f4aa868eaa93c0603e55
-
SHA1
aed6ca6891c504036b95f9cc9052098f811edfb2
-
SHA256
98baacd2e79fec0abb89cab6f91c80cedbf7fe28187732f1353c2d8056c9e5ae
-
SHA512
6781085e9faf66728f0a64a3fe622e93835f020e347cf83a042d3dc44d2e7c22364fd00bbac60388e595439f2931fa33e770013706cb604568d8ade948e752a5
-
SSDEEP
6144:qcfdYhUWloOts1U0S6fZQEWXkgjXrY5ejSKWdX:9MplPIXQEWXkwYYjJWdX
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
Processes:
rundll32.exedescription ioc process File created C:\Windows\SysWOW64\”ð'311097-63 rundll32.exe File created C:\Windows\SysWOW64\0aeb rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe PID 2332 wrote to memory of 1708 2332 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb08fa2dbb00f4aa868eaa93c0603e55_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb08fa2dbb00f4aa868eaa93c0603e55_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1708-0-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB
-
memory/1708-1-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB
-
memory/1708-2-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB
-
memory/1708-5-0x0000000000180000-0x0000000000182000-memory.dmpFilesize
8KB
-
memory/1708-6-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB
-
memory/1708-7-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB
-
memory/1708-8-0x0000000010000000-0x00000000100A5000-memory.dmpFilesize
660KB