18fb20ed7ff9283ccc1bc57009a2b386120b62a3160c3a29e71224a7985814a9

Analysis

max time kernel
0s
max time network
0s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/06/2024, 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe
Size

183KB
MD5

17546c6eefe30582794148e2c44b139f
SHA1

174834367ee22cb6a8363bcfffb35721bf704292
SHA256

18fb20ed7ff9283ccc1bc57009a2b386120b62a3160c3a29e71224a7985814a9
SHA512

d15e1640de3b98567025f71f7b2070087b6b362fd5ba752ffd9db12985d5f3222cb67848ceeec3fa66413cedc3373e2b206ee84d9e19c693ae98ca39fcef25ea
SSDEEP

3072:DQIURTXJ+MMrO+zWsLU9HmWAjT2T8upS8XyrdxhDRGChzjq40IiZS6nbSmujGlaU:Ds9Az9UtpTjfIdRXP0Iis6nkGVr

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe
2144	rundll32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\tmrllozg.dll	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\Registry\Machine\SOFTWARE\Classes\Wow6432Node\CLSID\{00000000-0000-0000-0000-000000000000}\	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28
PID 2416 wrote to memory of 2144	2416	17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17546c6eefe30582794148e2c44b139f_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Windows\system32\tmrllozg.dll",DllMain
  2⤵
  - Loads dropped DLL
  - Modifies registry class
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\tmrllozg.dll

Filesize
183KB

MD5
440dd855fbe2c10aa8fa70f09cb208ec

SHA1
5499a0ee810cc7d4deeb48b7b394c3bfb3f935fd

SHA256
4e354cd5d03c9cec1754ad60748fe35369b8fa50d870e28026835f84b8143a09

SHA512
41a6ac3d2bf2f6d29a05a92aa20a25b4f80182c06ecab506931c477b06fc0b41f5cc3c9cc5a3e3c3204449fb31116f26d2678844d0933383272645dd9b817d7f

Download Submit
memory/2144-11-0x00000000002A0000-0x00000000002CE000-memory.dmp

Filesize
184KB

Download
memory/2144-9-0x00000000001E0000-0x0000000000212000-memory.dmp

Filesize
200KB

Download
memory/2144-8-0x00000000001B0000-0x00000000001DE000-memory.dmp

Filesize
184KB

Download
memory/2144-7-0x00000000002A0000-0x00000000002CE000-memory.dmp

Filesize
184KB

Download