0e859bd598f16e162c02e9c74a8d38de64429d2acec20742aeb975b40205ec3a

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
04-07-2024 19:52

Target

260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll
Size

60KB
MD5

260ee6c702ba0fd322f656ea0985cca0
SHA1

b303e76a1634f38abf5c1dc9709dd9f2976bd9f6
SHA256

0e859bd598f16e162c02e9c74a8d38de64429d2acec20742aeb975b40205ec3a
SHA512

88583b0311653ec46b630f798be63447e96894ae1a298cb9a6c08f0f40805fbeac14f1962a162a2e8ff644e126661435422ce8d73483850b7862cbbe213006fe
SSDEEP

768:fovqSo4WMZVjPl5g0MLw16BcWG2RsMVBhhUwahuF6iPsZCY2WIaxyGIXH35Yzm:foSS/7XjPKM2RsCTUsFDPsR/XypnEm

Score

6^/10

discovery

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2040	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28
PID 1560 wrote to memory of 2040	1560	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\260ee6c702ba0fd322f656ea0985cca0_JaffaCakes118.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/2040-1-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/2040-0-0x0000000000130000-0x0000000000139000-memory.dmp

Filesize
36KB

Download
memory/2040-5-0x0000000000130000-0x0000000000139000-memory.dmp

Filesize
36KB

Download
memory/2040-6-0x0000000000130000-0x0000000000139000-memory.dmp

Filesize
36KB

Download