eee3b8d43b122be95c900e2ac0aa65f01d0e865733c8fdd95dc44883cdb4ef14

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
20-06-2024 03:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

024cb1fc106d8e239a78586207c16a79_JaffaCakes118.dll
Size

171KB
MD5

024cb1fc106d8e239a78586207c16a79
SHA1

6593d0a147f9e0362930ec4cf7bc49e50eb2dab1
SHA256

eee3b8d43b122be95c900e2ac0aa65f01d0e865733c8fdd95dc44883cdb4ef14
SHA512

1b64cbfb667872bae4aff91525b11c4d3cb8aa57e39abcecc3b8c180d20478d410452bccdbc6707524782def2a6ad15c678f820aedda4028ee94b2b7435e7058
SSDEEP

3072:34I4PZu4/0o+ECKcbZcoKM5mPS/Gnj/Pb1/eeP+X29mwaTNUbVc3JhjqKoRn3e:v4Qu9+EfMsPS4eX29la2ZWFqHh

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = ",rundll32.exe C:\\Windows\\system32\\061120.dll start"	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4144	380	WerFault.exe	83

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 380	1580	rundll32.exe	83
PID 1580 wrote to memory of 380	1580	rundll32.exe	83
PID 1580 wrote to memory of 380	1580	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\024cb1fc106d8e239a78586207c16a79_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\024cb1fc106d8e239a78586207c16a79_JaffaCakes118.dll,#1
  2⤵
  - Modifies WinLogon for persistence
  PID:380
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 380 -s 1168
    3⤵
    - Program crash
    PID:4144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 380 -ip 380
1⤵
PID:3928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/380-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-1-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-2-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-3-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-4-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-5-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/380-6-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads