Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-06-2024 07:22

General

  • Target

    03fbd692373d259aa49042c167c526dd_JaffaCakes118.dll

  • Size

    521KB

  • MD5

    03fbd692373d259aa49042c167c526dd

  • SHA1

    c7debeff17831d13913341a56d0620f832083bef

  • SHA256

    9ae3c383f3dc0fad0175a3cd5fc4d5434ac35202237242b16bdc1486bb5242cc

  • SHA512

    43023138f5c2ec19d162907353794e16bf30b0aff60078b5be106af01fb6c1261b4dcb2c2107e137c1b21f8c5967ddde6b6731266239e5f0932972bc98ca17bb

  • SSDEEP

    384:zBPyZNjtU2mHkKxv3S9Xh6h6q1G2TblJR6J6xBHzrWRk2rGlGlGlGlGlGlGlGlG4:zZyZNm3I6cq1HBkwrWRkq

Score
6/10

Malware Config

Signatures

  • Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fbd692373d259aa49042c167c526dd_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\03fbd692373d259aa49042c167c526dd_JaffaCakes118.dll,#1
      2⤵
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~DFD240665765.bat
        3⤵
          PID:4576
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1388 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:976

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\~DFD240665765.bat

        Filesize

        121B

        MD5

        09517fc62284f33e877a276463580bd1

        SHA1

        0b14fe1db4493818f9de0bf2a56ee5370b8d479a

        SHA256

        6cc6bbb1f3f754b6894d84130f5f2d86569ac3a603e1632d3cefa028f22b6238

        SHA512

        1b924dd216d0f38199cc6df215e65ff260aa48fa37aa620dabcbc616f434643bd1f2e617d66b14bd52900214148741565128ba9589782ba582fd7308369f4a4d