Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
27/06/2024, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll
Resource
win10v2004-20240611-en
General
-
Target
143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll
-
Size
320KB
-
MD5
143aa280a68985cb3717c231a5b65797
-
SHA1
570114450d081af9aa32a3a67da00857bb8948c4
-
SHA256
982b57b767c9429a774e83f9cfde6580a94e8c3f23f174bbcfd2f47fd49f934c
-
SHA512
ea8df978989852cea8510e799cf9ca9016acfba9a58bb0a72e352eaf1e93d12dba2dca4e5b82cff268736cd3f81978ef39214451e4c4d4dfe59aded12227be0f
-
SSDEEP
1536:tFsIMnoeoYPgEHZwgY7y9JPfH371DRjCLvYlwurfiCVMQJ2aNRf5BvV:L+JJgEHTXPfHzj9lwwMsRvvV
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2132 rundll32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\oficx.dll rundll32.exe File opened for modification C:\Windows\oficx.dll rundll32.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 2132 rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll,1293806123,-321515699,-1814625877" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe 2132 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4912 wrote to memory of 3420 4912 rundll32.exe 82 PID 4912 wrote to memory of 3420 4912 rundll32.exe 82 PID 4912 wrote to memory of 3420 4912 rundll32.exe 82 PID 3420 wrote to memory of 2132 3420 rundll32.exe 86 PID 3420 wrote to memory of 2132 3420 rundll32.exe 86 PID 3420 wrote to memory of 2132 3420 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\143aa280a68985cb3717c231a5b65797_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\oficx.dll",_RunAs@163⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Access Token Manipulation: Create Process with Token
- Suspicious behavior: EnumeratesProcesses
PID:2132
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
320KB
MD5143aa280a68985cb3717c231a5b65797
SHA1570114450d081af9aa32a3a67da00857bb8948c4
SHA256982b57b767c9429a774e83f9cfde6580a94e8c3f23f174bbcfd2f47fd49f934c
SHA512ea8df978989852cea8510e799cf9ca9016acfba9a58bb0a72e352eaf1e93d12dba2dca4e5b82cff268736cd3f81978ef39214451e4c4d4dfe59aded12227be0f