b4c617f06516b2262406442ceeac11624d29f720758443519cbe908afee49b39

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26f7b2a61583a1dc0e0c44fe61ed4433_JaffaCakes118.dll
Size

114KB
MD5

26f7b2a61583a1dc0e0c44fe61ed4433
SHA1

45c2ccb64094b890274e9c01d0e4bef7e268324b
SHA256

b4c617f06516b2262406442ceeac11624d29f720758443519cbe908afee49b39
SHA512

4ffb10bc5022add55d7224363d6529789d829c69739c83b1d2a6890f196b159ac9fd22a96bc7cb44c2ecc1319618df0a3e31f6e6002835c2c521a8198cc95c02
SSDEEP

3072:IdpgMxsdSyg4TvtcMk8Lyzb8ckivlu5KViCbmN:Mpl2GkGMkSgb8Svlu5KVON

Score

8^/10

persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 3 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{npjttwsa-wakl-qfuq-kjfp-pqdogddonggw}\stubpath = "þÿÿÿX"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{npjttwsa-wakl-qfuq-kjfp-pqdogddonggw}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{npjttwsa-wakl-qfuq-kjfp-pqdogddonggw}\ = "ÏµÍ³ÉèÖÃ"	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28
PID 2932 wrote to memory of 2948	2932	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26f7b2a61583a1dc0e0c44fe61ed4433_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\26f7b2a61583a1dc0e0c44fe61ed4433_JaffaCakes118.dll,#1
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads