Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
30d866711c402b6a635213239a6ee299_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
30d866711c402b6a635213239a6ee299_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
30d866711c402b6a635213239a6ee299_JaffaCakes118.exe
-
Size
50KB
-
MD5
30d866711c402b6a635213239a6ee299
-
SHA1
e5102fe0a20b9b63e309da3d748b032b97ef6074
-
SHA256
893595dc6a4871753210511606d2881a26bb40a5cd70ec4f0c65630c233e6eb5
-
SHA512
f0c284a7b12f446d0eac9d5403c929f63c28567ac3197b6de7e6b13df1da82511c7eb34396c81e3cf9caf0836ee940fc92daceca17c4200f9d7aa35d57fc7d7b
-
SSDEEP
768:fvsEUoVH8RqYkgdrh1uON43V7oLQgbqwtzU3XH8Oci4nJGnReRAT2L6/zDbWxIF1:s2t8Rq6phXbcgbqOzxvngnReaiOziI3
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 2728 rundll32.exe -
resource yara_rule behavioral2/memory/1316-3-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/1316-2-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/1316-5-0x0000000000400000-0x0000000000412000-memory.dmp upx behavioral2/memory/1316-12-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/1316-13-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/1316-11-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/1316-19-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/2728-29-0x0000000010000000-0x0000000010014000-memory.dmp upx behavioral2/memory/2728-33-0x0000000010000000-0x0000000010014000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\wvUkHYqn.dll,#1" rundll32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wvUkHYqn.dll 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe File opened for modification C:\Windows\SysWOW64\nnnnLeCs.dll 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe File created C:\Windows\SysWOW64\nnnnLeCs.dll 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe File created C:\Windows\SysWOW64\wvUkHYqn.dll 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe -
Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{299B5FAC-2168-4A5D-A67D-AA4C8F8055DA} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{299B5FAC-2168-4A5D-A67D-AA4C8F8055DA}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{299B5FAC-2168-4A5D-A67D-AA4C8F8055DA}\InprocServer32\ = "C:\\Windows\\SysWow64\\wvUkHYqn.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{299B5FAC-2168-4A5D-A67D-AA4C8F8055DA}\InprocServer32\ThreadingModel = "Both" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe 2728 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1316 wrote to memory of 612 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 5 PID 1316 wrote to memory of 2728 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 87 PID 1316 wrote to memory of 2728 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 87 PID 1316 wrote to memory of 2728 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 87 PID 1316 wrote to memory of 932 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 88 PID 1316 wrote to memory of 932 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 88 PID 1316 wrote to memory of 932 1316 30d866711c402b6a635213239a6ee299_JaffaCakes118.exe 88
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\wvUkHYqn.dll,a2⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\removalfile.bat "C:\Users\Admin\AppData\Local\Temp\30d866711c402b6a635213239a6ee299_JaffaCakes118.exe"2⤵PID:932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43B
MD59a7ef09167a6f4433681b94351509043
SHA1259b1375ed8e84943ca1d42646bb416325c89e12
SHA256d5739a0510d89da572eb0b0d394d4fb4dd361cd9ee0144b9b31c590df93c3be7
SHA51296b84cd88a0e4b7c1122af3ed6ce5edf0a9a4e9bf79575eadfac16b2c46f1278d57755d29f21d7c6dcb4403be24b7ac7da4837c6cc9c602342a8f2b8e54883df
-
Filesize
33KB
MD565a6bc84fccd148329869bd9380b97dc
SHA11b07cbfcd17b1c1fda84b06f4c352a350bcf582e
SHA256770ffa9abb7f1ac8118984c550c8dd056e35e6a3727df47b3d3ed8b7f120f7dd
SHA5128113d7b50b9e9ff9a96cf499d5071b19369b2c74e91ca64976f1ce61591d0171186207abac936675c5f1c1c9c4ff0fa7190040e4c1f0db0831d561e8076aa3cb