Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 23:33
Static task
static1
Behavioral task
behavioral1
Sample
0ff09f374cdab927fcb1745237943c6d_JaffaCakes118.dll
Resource
win7-20240508-en
General
-
Target
0ff09f374cdab927fcb1745237943c6d_JaffaCakes118.dll
-
Size
104KB
-
MD5
0ff09f374cdab927fcb1745237943c6d
-
SHA1
e545ba440733088b12f7d62273e7b2e82ba3f8af
-
SHA256
f83ceacc2db5a00a91af105fa593e483d251106117f63f8a517f06a4ad229f9e
-
SHA512
395fb095bc76e614abb4ced8851b5287e36d4c583639bd20d6b52fe6b76cc5a6f063660acd4b87be34b86bd0ca4d71d4bc5e7cdae409a6f50e510e6dfaef5458
-
SSDEEP
1536:EFb/gIdEvnFbOaE/CCVD2DophGdE45fIJLYOMvedtYYBhp1:EFVd8nllE/CEp149IGNedtY6p1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2408 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 2116 rundll32.exe 2116 rundll32.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe 1704 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2004 2116 WerFault.exe 28 1704 2408 WerFault.exe 29 -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 1776 wrote to memory of 2116 1776 rundll32.exe 28 PID 2116 wrote to memory of 2408 2116 rundll32.exe 29 PID 2116 wrote to memory of 2408 2116 rundll32.exe 29 PID 2116 wrote to memory of 2408 2116 rundll32.exe 29 PID 2116 wrote to memory of 2408 2116 rundll32.exe 29 PID 2116 wrote to memory of 2004 2116 rundll32.exe 30 PID 2116 wrote to memory of 2004 2116 rundll32.exe 30 PID 2116 wrote to memory of 2004 2116 rundll32.exe 30 PID 2116 wrote to memory of 2004 2116 rundll32.exe 30 PID 2408 wrote to memory of 1704 2408 rundll32mgr.exe 31 PID 2408 wrote to memory of 1704 2408 rundll32mgr.exe 31 PID 2408 wrote to memory of 1704 2408 rundll32mgr.exe 31 PID 2408 wrote to memory of 1704 2408 rundll32mgr.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff09f374cdab927fcb1745237943c6d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0ff09f374cdab927fcb1745237943c6d_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2408 -s 1564⤵
- Loads dropped DLL
- Program crash
PID:1704
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 2243⤵
- Program crash
PID:2004
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350