0f1ea0eda98e889de666f5076d28a3f9e5cfed23655ab1a857b1385c3e62974a | Triage

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 22:52

Sharing

Report Analysis Logs

General

Target

23bc9dc49cd9a6d7222a2614c8f6dbf5_JaffaCakes118.dll
Size

27KB
MD5

23bc9dc49cd9a6d7222a2614c8f6dbf5
SHA1

0bf888412c3bd4c89e7cab9f1c40feee9c6f4a88
SHA256

0f1ea0eda98e889de666f5076d28a3f9e5cfed23655ab1a857b1385c3e62974a
SHA512

de9df27d03a38fb73ff4d0ceb22e6a967adb35642c760c05d6d217d3a950ef3ced7f0f5f07b1f8c3f0abe653bb926851abcc7ca3a07c16151eceff3ad5ec9952
SSDEEP

768:WYCf8qdSJQlh5hEf1T2eo/tdUfEBQrGW:WfkqYJQn7EYVufECG

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\checkcj.ini	rundll32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4388	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 940 wrote to memory of 4388	940	rundll32.exe	83
PID 940 wrote to memory of 4388	940	rundll32.exe	83
PID 940 wrote to memory of 4388	940	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\23bc9dc49cd9a6d7222a2614c8f6dbf5_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:940
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\23bc9dc49cd9a6d7222a2614c8f6dbf5_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - Suspicious behavior: GetForegroundWindowSpam
  PID:4388

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4388-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4388-8-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/4388-15-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download