2e4d842dc16ec758a4538d0f923956d423ab23af645e6e2a48621c2ad2a300b8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:15

Target

25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll
Size

60KB
MD5

25f20c22a9ba8818591b2182c17fbc61
SHA1

0105ad4bf9397bd8a0002509f2634bf15dc9c7fa
SHA256

2e4d842dc16ec758a4538d0f923956d423ab23af645e6e2a48621c2ad2a300b8
SHA512

5c59dcd6c04db8ca33d8d6400536b7dc00e3151ee45d9e18e0338739c533cb3c6749ba658be25f0454dde86ff48be08dd36e23eab4fb989460eeb34d5466b937
SSDEEP

768:KWLcO15vNfGk9R5NOR1YYQSoMI8ahjaHP8shIEK+/YIPDP59p0XyPc2v8QNh:KWL/51frWR5oVMv8izKQPPDuik88QH

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1036	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28
PID 2380 wrote to memory of 1036	2380	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\25f20c22a9ba8818591b2182c17fbc61_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1036

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1036-0-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1036-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/1036-5-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download