Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/07/2024, 07:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll
Resource
win10v2004-20240704-en
3 signatures
150 seconds
General
-
Target
2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll
-
Size
152KB
-
MD5
2f7631b1d16ed2673fcd2f625cab4602
-
SHA1
ea1ebe80ad7948d36d49e7c81191f00ff7c9417c
-
SHA256
fa98c6f25052ce6a851148439091efad9b734b89b094b6e60610cc8b216946de
-
SHA512
6c65d91048b02024ee8a59ef1e4ee3fd59e291d7a812d63b47bb7995498e3a9faaf059b7ff98869160c0afb7037d25cfc51ee7b2ad9b2e939051004e7889c152
-
SSDEEP
3072:OMcOBW8VgdbgssPtinyOt1I4xdFArBPM1bs:OMcOBW8qAl4yzIOrxM1
Score
1/10
Malware Config
Signatures
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C1B9CE-1A6F-4994-B4A4-0E7C99AD4C28}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1640 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 2292 wrote to memory of 1640 2292 rundll32.exe 30 PID 1640 wrote to memory of 1200 1640 rundll32.exe 21
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1200
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f7631b1d16ed2673fcd2f625cab4602_JaffaCakes118.dll,#13⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1640
-
-