8fe036581f575ac296def85993218f573c87bb285779a12c612912f469e49f01 | Triage

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/06/2024, 18:57

Sharing

Report Analysis Logs

General

Target

08ddfeb45eec557429e296290503b09f_JaffaCakes118.dll
Size

840KB
MD5

08ddfeb45eec557429e296290503b09f
SHA1

a8a8f195c3b172a17131bef15280f367ef32d634
SHA256

8fe036581f575ac296def85993218f573c87bb285779a12c612912f469e49f01
SHA512

7b70c49833688ab87bb9463b69d39e5526cbabfc35f0f9c283db23aed7ac24897ffefe843c525eef93bd1eb39b7423144ae638b1ef990ba5629708f55c7ece07
SSDEEP

24576:Or8ekGsN/zp4P7T6/cZ970lhgwnjz/RI:OENUC6ClDjzpI

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1732	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28
PID 2820 wrote to memory of 1732	2820	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ddfeb45eec557429e296290503b09f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\08ddfeb45eec557429e296290503b09f_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1732

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads