c9001b69411f2e394ce2d389e95c40a25d46feda77ec40ec3b985cec97729ff1

Analysis

max time kernel
93s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 02:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll
Size

1.8MB
MD5

2ea21579b24900f0160a83c6c0a90400
SHA1

a9beaf5fab0e5cf7fdbc7252e83cfec1e0d83909
SHA256

c9001b69411f2e394ce2d389e95c40a25d46feda77ec40ec3b985cec97729ff1
SHA512

0485d19dc7d6f119b9d96c39de9946c339a51b042b52c8a97f394a8dfabb793c7b0894d75373067b6e7190c04d84dd43b8e90e23133688c0c925d2d5c65a9951
SSDEEP

24576:NiA+J+1t7wTIMP1kB9oPCgiHwS8zzjOFDnd79Jduly2qZfd2yy:NiawLusdiHwXXj4Dnd7xpoyy

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe livehelp.exe"	Regedit.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
8	4396	rundll32.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\eaJkuDyg8.dll	rundll32.exe
File created	C:\WINDOWS\SysWOW64\wbem\XOQHE.MDA	rundll32.exe
File created	C:\windows\SysWOW64\TQUEU.DLL	rundll32.exe
File opened for modification	C:\windows\SysWOW64\TJZPUPTCAQGXUSO.DLL	rundll32.exe
File created	C:\windows\SysWOW64\MDRZQNKUKARX.LDO	rundll32.exe
File created	C:\Windows\SysWOW64\eaJkuDyg8.dll	rundll32.exe
File created	C:\windows\SysWOW64\TJZPUPTCAQGXUSO.DLL	rundll32.exe
File opened for modification	C:\WINDOWS\SysWOW64\wbem\XOQHE.MDA	rundll32.exe
File created	C:\Windows\SysWOW64\arun.reg	rundll32.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2232	Regedit.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 4396	4044	rundll32.exe	82
PID 4044 wrote to memory of 4396	4044	rundll32.exe	82
PID 4044 wrote to memory of 4396	4044	rundll32.exe	82
PID 4396 wrote to memory of 2232	4396	rundll32.exe	86
PID 4396 wrote to memory of 2232	4396	rundll32.exe	86
PID 4396 wrote to memory of 2232	4396	rundll32.exe	86

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2ea21579b24900f0160a83c6c0a90400_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\Regedit.exe
    Regedit.exe /s "C:\Windows\SysWOW64\arun.reg"
    3⤵
    - Modifies WinLogon for persistence
    - Runs .reg file with regedit
    PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\arun.reg

Filesize
151B

MD5
57e1d7404760f999f86fb048b02a09ca

SHA1
aaba87ae0923bb92e7d1da9b333cbbc8403f4fa5

SHA256
070caf4bc4ed2c56f0e2331e93bd9e94b073d62d8e1e9b5ec393932090d52a76

SHA512
d4f4d9edd81eb4a8841ccd25ca2812b5a1c0bf391aae6d3c606c4c9abb2505b84cdd4b67dcf8246d30e074f6a5abdf5260e4a7e99f973fffcff0a211fcd933c8

Download Submit
C:\Windows\SysWOW64\eaJkuDyg8.dll

Filesize
1KB

MD5
e957637ff134ba0feab3585fde0825dd

SHA1
4203d9cea79137d2cdf113006e8591855ba1adc7

SHA256
aacb5191ac375a1267bbeb6dda2f5c55471ac019afbe273834d6ec61890696ba

SHA512
85dce6bc281983a63d3ca40f0ae525962c80a6b8bd16cec063964533c2ee20be2dcd9193823a06aa469c617fd38bf59ff1bdb98a1c386a1b519841d70dcba15e

Download Submit
memory/4396-0-0x0000000001F60000-0x0000000002126000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads