Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 08:29
Static task
static1
Behavioral task
behavioral1
Sample
0060230d80dcbcbddc34233d300730b1_JaffaCakes118.dll
Resource
win7-20240220-en
General
-
Target
0060230d80dcbcbddc34233d300730b1_JaffaCakes118.dll
-
Size
92KB
-
MD5
0060230d80dcbcbddc34233d300730b1
-
SHA1
2aa8618a69e41d3cefdee303a51ffda6fd094b95
-
SHA256
d42f72e21b55109db9a44d26d066f86e0c09c6e80e48bd5ec63f6d31d236e62b
-
SHA512
30485da212cba9324e9b1a65865fe15f8c640b9d85ea7ff8b49c7df2b2733681356bf8477866d08d0e4538ad420b366d99ea6eac04bee7945739bb945f28fd6a
-
SSDEEP
1536:gy5iJAqTiZg4FvOnAWEhMogLYS3LORwQzv8EuRkzmWuxM:XU0me6ogLdOepEuNWuxM
Malware Config
Signatures
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeImpersonatePrivilege 2160 rundll32.exe Token: SeTcbPrivilege 2160 rundll32.exe Token: SeChangeNotifyPrivilege 2160 rundll32.exe Token: SeCreateTokenPrivilege 2160 rundll32.exe Token: SeBackupPrivilege 2160 rundll32.exe Token: SeRestorePrivilege 2160 rundll32.exe Token: SeIncreaseQuotaPrivilege 2160 rundll32.exe Token: SeAssignPrimaryTokenPrivilege 2160 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28 PID 2932 wrote to memory of 2160 2932 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0060230d80dcbcbddc34233d300730b1_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0060230d80dcbcbddc34233d300730b1_JaffaCakes118.dll,#12⤵
- Suspicious use of AdjustPrivilegeToken
PID:2160
-