Analysis
-
max time kernel
117s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20-04-2024 00:07
Static task
static1
Behavioral task
behavioral1
Sample
fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll
Resource
win10v2004-20240412-en
General
-
Target
fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll
-
Size
56KB
-
MD5
fb78ab2b5f79a86527db6b09f86e1456
-
SHA1
56afe96200bc74068b8cea56a93714cb9dc0a7e4
-
SHA256
e78d09ce890d86d608466ad3c63d42ff88d6764bd90e87b3142b91cdf008f8c1
-
SHA512
a3b67726b2e14724d216dcfde3a7347ad5b47631c34d10ea28a09445a55378a05e467380ed747dc1074cf556cf978ff9d994930e141b44ca7c88133c823eb6cd
-
SSDEEP
768:s/XVBm4CjxKQfgsbcoPxVjy2YWhIazCWtppp1oHVXni1pflhfyvXumAw:4yhtKQIaf4hazCWjgV3gfr4XSw
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
rundll32.exedescription ioc process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 1720 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe PID 1676 wrote to memory of 1720 1676 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb78ab2b5f79a86527db6b09f86e1456_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1720