Analysis
-
max time kernel
85s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
3904de0b43c9fdd728646c79a52c6d18_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
3904de0b43c9fdd728646c79a52c6d18_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
3904de0b43c9fdd728646c79a52c6d18_JaffaCakes118.dll
-
Size
55KB
-
MD5
3904de0b43c9fdd728646c79a52c6d18
-
SHA1
76d0190dc432015cd095470a2efc659cc69387c3
-
SHA256
ff776a93ec37dc4217a7778f19ddd3e3775767d4b364c9c0a2367d23b6af4c69
-
SHA512
37cec2104dbfc2e17b92ca4782a7e7e3058f63dadf222b3f2b66f90ead5a3077eb766fbfef0ba9568b217373567e3b64ec16f56d8086d0c937ccd16889aa3118
-
SSDEEP
1536:mS/USJwUkmEocPG4nU1VuKOX08FIZHszmJE:noLocPG4UCVX0dZMF
Malware Config
Signatures
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe 2008 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2008 2460 rundll32.exe 83 PID 2460 wrote to memory of 2008 2460 rundll32.exe 83 PID 2460 wrote to memory of 2008 2460 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3904de0b43c9fdd728646c79a52c6d18_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3904de0b43c9fdd728646c79a52c6d18_JaffaCakes118.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008
-