Analysis
-
max time kernel
140s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 23:27
Behavioral task
behavioral1
Sample
3718fe99f772c81aa908369cd7279eac_JaffaCakes118.dll
Resource
win7-20240221-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
3718fe99f772c81aa908369cd7279eac_JaffaCakes118.dll
Resource
win10v2004-20240426-en
5 signatures
150 seconds
General
-
Target
3718fe99f772c81aa908369cd7279eac_JaffaCakes118.dll
-
Size
170KB
-
MD5
3718fe99f772c81aa908369cd7279eac
-
SHA1
34f02fba4e619d718b69bec2152a75683fa6a3c8
-
SHA256
c4f3e1c36ef734927967d40bba87fc620abe5c5049b0e67fd3cc3dab9c763c7a
-
SHA512
a86468e74665e1b26cb3233a84e4eae4c950b7c6ab24bd680c0da836cb8691eeae6b92dd8c603c1e03fcfc1c9c11f8a277b99a1d0d0b5e188ea03db4fc68df2c
-
SSDEEP
3072:REOpmT46vL0hxtHlGAJyezW+iVu8FsVWswU5rp4h:RiTvvAhfAAJrriVdsVWGI
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msiexec.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Excoyre = "rundll32.exe C:\\Users\\Admin\\AppData\\Roaming\\Ynsuy\\usbyq.dll,DllRegisterServer" msiexec.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
regsvr32.exedescription pid process target process PID 1584 set thread context of 512 1584 regsvr32.exe msiexec.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
msiexec.exedescription pid process Token: SeSecurityPrivilege 512 msiexec.exe Token: SeSecurityPrivilege 512 msiexec.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
regsvr32.exeregsvr32.exedescription pid process target process PID 1456 wrote to memory of 1584 1456 regsvr32.exe regsvr32.exe PID 1456 wrote to memory of 1584 1456 regsvr32.exe regsvr32.exe PID 1456 wrote to memory of 1584 1456 regsvr32.exe regsvr32.exe PID 1584 wrote to memory of 512 1584 regsvr32.exe msiexec.exe PID 1584 wrote to memory of 512 1584 regsvr32.exe msiexec.exe PID 1584 wrote to memory of 512 1584 regsvr32.exe msiexec.exe PID 1584 wrote to memory of 512 1584 regsvr32.exe msiexec.exe PID 1584 wrote to memory of 512 1584 regsvr32.exe msiexec.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\3718fe99f772c81aa908369cd7279eac_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\3718fe99f772c81aa908369cd7279eac_JaffaCakes118.dll2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe3⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/512-0-0x00000000004B0000-0x00000000004E0000-memory.dmpFilesize
192KB