168213e03b87d1509e4e2269a890b11dcc32a8a6a85491a49778e00eb7c2642b

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25/06/2024, 22:49

Target

0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll
Size

47KB
MD5

0fd101d3ac9ad4f3d8bce36e31a57208
SHA1

d00462f3f61fbcb09f04249c82ba1b60844dafbd
SHA256

168213e03b87d1509e4e2269a890b11dcc32a8a6a85491a49778e00eb7c2642b
SHA512

552f19ec3c0cebe917e40c7fef5c508b93cb812dc139c3e5af684ae8834a2ae7a49c6583544103212b8823b9d0fe8691d50b18bb334494a2ef039de7c41bb1cc
SSDEEP

768:r0KOVu7l/DN9sHS11EE7dIxI0kcjGkssOhN2TJ/IYoEtkNkauPEJ:T/DLsHS11EbH5bOhN+/IYoEu6pEJ

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2372	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28
PID 2352 wrote to memory of 2372	2352	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fd101d3ac9ad4f3d8bce36e31a57208_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2372-3-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download
memory/2372-0-0x0000000000100000-0x0000000000108000-memory.dmp

Filesize
32KB

Download