c9001b69411f2e394ce2d389e95c40a25d46feda77ec40ec3b985cec97729ff1

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll
Size

1.8MB
MD5

2ea21579b24900f0160a83c6c0a90400
SHA1

a9beaf5fab0e5cf7fdbc7252e83cfec1e0d83909
SHA256

c9001b69411f2e394ce2d389e95c40a25d46feda77ec40ec3b985cec97729ff1
SHA512

0485d19dc7d6f119b9d96c39de9946c339a51b042b52c8a97f394a8dfabb793c7b0894d75373067b6e7190c04d84dd43b8e90e23133688c0c925d2d5c65a9951
SSDEEP

24576:NiA+J+1t7wTIMP1kB9oPCgiHwS8zzjOFDnd79Jduly2qZfd2yy:NiawLusdiHwXXj4Dnd7xpoyy

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe livehelp.exe"	Regedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
3	2400	rundll32.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ga8i1Ty1.dll	rundll32.exe
File created	C:\WINDOWS\SysWOW64\wbem\VTXVLBGDUSPAYCA.MDA	rundll32.exe
File created	C:\windows\SysWOW64\VQFHYPFXHAKAHQG.DLL	rundll32.exe
File created	C:\windows\SysWOW64\ECDUSPFC.LDO	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\ga8i1Ty1.dll	rundll32.exe
File created	C:\windows\SysWOW64\WBRSIZWMKAPE.DLL	rundll32.exe
File opened for modification	C:\WINDOWS\SysWOW64\wbem\VTXVLBGDUSPAYCA.MDA	rundll32.exe
File created	C:\Windows\SysWOW64\arun.reg	rundll32.exe
File opened for modification	C:\windows\SysWOW64\WBRSIZWMKAPE.DLL	rundll32.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2864	Regedit.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 3012 wrote to memory of 2400	3012	rundll32.exe	30
PID 2400 wrote to memory of 2864	2400	rundll32.exe	31
PID 2400 wrote to memory of 2864	2400	rundll32.exe	31
PID 2400 wrote to memory of 2864	2400	rundll32.exe	31
PID 2400 wrote to memory of 2864	2400	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\Regedit.exe
    Regedit.exe /s "C:\Windows\SysWOW64\arun.reg"
    3⤵
    - Modifies WinLogon for persistence
    - Runs .reg file with regedit
    PID:2864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arun.reg

Filesize
151B

MD5
57e1d7404760f999f86fb048b02a09ca

SHA1
aaba87ae0923bb92e7d1da9b333cbbc8403f4fa5

SHA256
070caf4bc4ed2c56f0e2331e93bd9e94b073d62d8e1e9b5ec393932090d52a76

SHA512
d4f4d9edd81eb4a8841ccd25ca2812b5a1c0bf391aae6d3c606c4c9abb2505b84cdd4b67dcf8246d30e074f6a5abdf5260e4a7e99f973fffcff0a211fcd933c8

Download Submit
C:\Windows\SysWOW64\ga8i1Ty1.dll

Filesize
1KB

MD5
e6d32ed99ee74a87f222d57421bdf24f

SHA1
2724c6aa62f3f3ae46ca0f72a12e063ac15133f6

SHA256
d7123be975af11e775ba7edafde8dfa73fea8852494e0ba3d628ae28c103ac67

SHA512
598963a8599dda9dab4a6fc3714d29e8f1ee0f747e29f57b9024a0e8006d171fd6472ca2b65458b27449ed2849d6cee03cb71682c597c9ed4408a7a77d7036a0

Download Submit
memory/2400-0-0x0000000002010000-0x00000000021D6000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads