63728ac83bd19a58b8a95df794ec146eed122c8f2f6ef6b372727691c5b6ec0e

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 08:25

Target

2fa425258248531f7aea281a087b2ec3_JaffaCakes118.dll
Size

81KB
MD5

2fa425258248531f7aea281a087b2ec3
SHA1

e640a4274a40d5f65462955029bbd038fbecd247
SHA256

63728ac83bd19a58b8a95df794ec146eed122c8f2f6ef6b372727691c5b6ec0e
SHA512

596f3c2d40e6f1e13d2ef94597acc072c366c3352dd827d49c205d7e57780583a4df13b69cddbd4e7d745955c385469120c0c9e894400279f84e882c7781e144
SSDEEP

1536:UR3s9zRwbozkWUc5Sd3OXybFXkZUotwF0tyXZFMzVc+pQ+ItsYOeoe+8igQNgo:4SwMWc5Sd+myUCwF0tyUzVc5+tk+fZGo

Score

5^/10

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\MSHEIIJM.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\MSHEIIJM.dat	rundll32.exe
File created	C:\Windows\SysWOW64\VoiplT.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\VoiplT.dat	rundll32.exe
File created	C:\Windows\SysWOW64\RdpSaPc.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\RdpSaPc.dat	rundll32.exe
File created	C:\Windows\SysWOW64\urleyst.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\urleyst.dat	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C042A9A-F55A-DD8A-5B93-68449B4CE685}\InprocServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C042A9A-F55A-DD8A-5B93-68449B4CE685}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2fa425258248531f7aea281a087b2ec3_JaffaCakes118.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C042A9A-F55A-DD8A-5B93-68449B4CE685}\InprocServer32\ThreadingModel = "Apartment"	rundll32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{1C042A9A-F55A-DD8A-5B93-68449B4CE685}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1C042A9A-F55A-DD8A-5B93-68449B4CE685}\ = "2fa42525824"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3632	1052	rundll32.exe	82
PID 1052 wrote to memory of 3632	1052	rundll32.exe	82
PID 1052 wrote to memory of 3632	1052	rundll32.exe	82

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa425258248531f7aea281a087b2ec3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2fa425258248531f7aea281a087b2ec3_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - Modifies registry class
  PID:3632

memory/3632-0-0x000000007FB60000-0x000000007FB74000-memory.dmp

Filesize
80KB

Download
memory/3632-1-0x000000007FB30000-0x000000007FB5A000-memory.dmp

Filesize
168KB

Download
memory/3632-3-0x000000007FB60000-0x000000007FB74000-memory.dmp

Filesize
80KB

Download
memory/3632-4-0x000000007FB30000-0x000000007FB5A000-memory.dmp

Filesize
168KB

Download