Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll
-
Size
26KB
-
MD5
36b1851edfdb0f279c3e352ba06a3c44
-
SHA1
7a9bee1318ee88b70bdc35330ad708226434660e
-
SHA256
f7edb5c3fa2b0662d25b15c2814244b448729bba23afdf4d336a3acc4b5113ae
-
SHA512
f68b792d42145de38e9e5b3044caa308927d2ff69ec2ce665cc915ef70e343da19ccc590b2ad00e3f7b2473c3ad3bb203529c3b83b2c28934e1863e79ecbf2c4
-
SSDEEP
768:qru9I+eKJx3EzRroMYoKxyVhJQKBIN5/OvTvL:qrubMY6J/KervL
Score
5/10
Malware Config
Signatures
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\wimpc.dll rundll32.exe File opened for modification C:\Windows\wimpc.dll rundll32.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 2184 rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll,1298918360,682909044,-1814625877" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe 2184 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 808 wrote to memory of 1592 808 rundll32.exe 30 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31 PID 1592 wrote to memory of 2184 1592 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\36b1851edfdb0f279c3e352ba06a3c44_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\wimpc.dll",_RunAs@163⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Access Token Manipulation: Create Process with Token
- Suspicious behavior: EnumeratesProcesses
PID:2184
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD536b1851edfdb0f279c3e352ba06a3c44
SHA17a9bee1318ee88b70bdc35330ad708226434660e
SHA256f7edb5c3fa2b0662d25b15c2814244b448729bba23afdf4d336a3acc4b5113ae
SHA512f68b792d42145de38e9e5b3044caa308927d2ff69ec2ce665cc915ef70e343da19ccc590b2ad00e3f7b2473c3ad3bb203529c3b83b2c28934e1863e79ecbf2c4