c9a48630788e01af63ab9d04eeb8819f3188b47e941017977e5bd0e56ebba498 | Triage

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
03/07/2024, 06:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118.dll
Size

20KB
MD5

21733a2858bbf0ef3ecdb874e05b17dc
SHA1

e153034ba17b712cd20d954c72e4edba53abebf3
SHA256

c9a48630788e01af63ab9d04eeb8819f3188b47e941017977e5bd0e56ebba498
SHA512

1e7bda9b5619226ec08350e6208d3b36d4283a8921af76b97b6f1ab8028354c116b2ffa12e777365fc4dedc890fe638f7110ab2aa718d514a67db9dd4bc041a7
SSDEEP

384:fiGN3oDGP0qDLMj+6LZp9e/FudZpKIqJ:6GN3qiLQTIFkZpKIa

Score

1^/10

Malware Config

Signatures

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3F426F6-8634-42A5-A29E-BC694A88FB7D}\InprocServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3F426F6-8634-42A5-A29E-BC694A88FB7D}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3F426F6-8634-42A5-A29E-BC694A88FB7D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3F426F6-8634-42A5-A29E-BC694A88FB7D}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1192	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 2840 wrote to memory of 1192	2840	rundll32.exe	28
PID 1192 wrote to memory of 1368	1192	rundll32.exe	21

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1368
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\21733a2858bbf0ef3ecdb874e05b17dc_JaffaCakes118.dll,#1
    3⤵
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1192

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1192-2-0x0000000010001000-0x0000000010002000-memory.dmp

Filesize
4KB

Download
memory/1192-0-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1368-1-0x0000000002740000-0x0000000002741000-memory.dmp

Filesize
4KB

Download