Analysis
-
max time kernel
92s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2024, 05:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
29c495321dc151fbfb9d2350bafb0699_JaffaCakes118.dll
Resource
win7-20240220-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
29c495321dc151fbfb9d2350bafb0699_JaffaCakes118.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
29c495321dc151fbfb9d2350bafb0699_JaffaCakes118.dll
-
Size
303KB
-
MD5
29c495321dc151fbfb9d2350bafb0699
-
SHA1
973224cba6b3e031a12feba04a449d5d83048cc5
-
SHA256
dc5fd8e89b863c97ac9fbbb35211e9a55f21197f306536fd7557b87adee2e917
-
SHA512
054fe0cffc6c3504cd24096453648c7953a3118aacfb15d5a8812ec0ebb93f93bc93f1b949b1793bfdce3bc57d2ac47cf9e1157b7a5ad3a1781009ee129af58c
-
SSDEEP
6144:z4fp4WH8YFQMWfqXD1f6IASLCBFYQVLxAaBldOA0q4bZlE3zxh:zMpTHDFb+qXw5YaFOA0Pb0h
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fyrgtr.dll rundll32.exe File created C:\Windows\SysWOW64\fnhwe.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\fnhwe.dll rundll32.exe File created C:\Windows\SysWOW64\fyrgtr.dll rundll32.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe 4304 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 4304 rundll32.exe Token: SeDebugPrivilege 4304 rundll32.exe Token: SeDebugPrivilege 4304 rundll32.exe Token: SeDebugPrivilege 4304 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4040 wrote to memory of 4304 4040 rundll32.exe 82 PID 4040 wrote to memory of 4304 4040 rundll32.exe 82 PID 4040 wrote to memory of 4304 4040 rundll32.exe 82 PID 4304 wrote to memory of 3452 4304 rundll32.exe 56 PID 4304 wrote to memory of 3452 4304 rundll32.exe 56 PID 4304 wrote to memory of 2124 4304 rundll32.exe 38 PID 4304 wrote to memory of 2124 4304 rundll32.exe 38
Processes
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2124
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3452
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29c495321dc151fbfb9d2350bafb0699_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29c495321dc151fbfb9d2350bafb0699_JaffaCakes118.dll,#13⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4304
-
-