Analysis
- max time kernel
146s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240709-en - resource tags
- submitted
11/07/2024, 20:20
General
- Target 3a9503ce79a0ac3b6f2f38163d55554d_JaffaCakes118.dll
- Size 1.3MB
- Sample240711-y4ec4avdma
- SHA256 9941fd97327d54a18209d0bb1f36992a18a3809aa8d163e7fe80193a4348610a
Score
8/10
Malware Config
Signatures
- Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3a9503ce79a0ac3b6f2f38163d55554d_JaffaCakes118.dll,#11⤵
- Server Software Component: Terminal Services DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3164-0-0x00007FFE38CB0000-0x00007FFE38F5B000-memory.dmp
memory/3164-3-0x00007FFE38CB1000-0x00007FFE38CFA000-memory.dmp
memory/3164-2-0x00007FFE38CB0000-0x00007FFE38F5B000-memory.dmp