Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
10-07-2024 21:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll
Resource
win10v2004-20240704-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll
-
Size
13KB
-
MD5
3662b29282545a87370b41aa00e18b9d
-
SHA1
b364298cb41e893df4e70e53b9cf1e19dd4612f6
-
SHA256
4b2fc18cabddfbdee2677f23c4780c365cdfe1a2ee3810d57f6f04de26e52fbe
-
SHA512
b383d2735d602043fee4d264b157efa560185d4cdee0064acf1a2b72b306b02fcaccb0e5a5622d32d5cb3ddabe29721a5d19e6d581845a396d63facc90534b91
-
SSDEEP
384:foHNSTRf1P73V6p5XXd4k61FF1TJo1yg6F:foHNefVgWk61Fdn
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
rundll32.exepid process 2960 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
rundll32.exedescription pid process Token: SeDebugPrivilege 2960 rundll32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2944 wrote to memory of 2960 2944 rundll32.exe rundll32.exe PID 2960 wrote to memory of 432 2960 rundll32.exe winlogon.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:432
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3662b29282545a87370b41aa00e18b9d_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960