c98bd21d5d38982cb564426f5736e73a4ad1225f645068ba799022d54e297a47

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

00a423c1829691a77afd73310734a6c0_JaffaCakes118.dll
Size

8KB
MD5

00a423c1829691a77afd73310734a6c0
SHA1

818e9c973fe23c8b8be32df0519d3b96a86db54a
SHA256

c98bd21d5d38982cb564426f5736e73a4ad1225f645068ba799022d54e297a47
SHA512

ac1b9051ff03403f40f78ff01931ba272f6734bbcc48194d88bcfc93bdb833bbfc48da6e16bc2bbd8c2c3470201252ffa38ab488cb85902b20a5ec8d63635eea
SSDEEP

192:1oSQk8XddHSMkW80a9s05Fl9XmstLOcsWaTtIkgUwuX:1QkW98/G0V9XdtLUW4XJ

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe
3168	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3168	rundll32.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3168	4972	rundll32.exe	92
PID 4972 wrote to memory of 3168	4972	rundll32.exe	92
PID 4972 wrote to memory of 3168	4972	rundll32.exe	92
PID 3168 wrote to memory of 3444	3168	rundll32.exe	55

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3444
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\00a423c1829691a77afd73310734a6c0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\00a423c1829691a77afd73310734a6c0_JaffaCakes118.dll,#1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4420,i,6870419347051655189,5491911050420577193,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x0000000025000000-0x0000000025014000-memory.dmp

Filesize
80KB

Download