90bf2e24fd9833156245d54996fa06dcdb2dc2a1465852249728fa78d2554035

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/07/2024, 01:25

Target

3b7c948ea1cc9c30c94a2068b6881d1c_JaffaCakes118.dll
Size

8KB
MD5

3b7c948ea1cc9c30c94a2068b6881d1c
SHA1

94050d1a7b11ac0fd06fc6b4e81da8d29a433498
SHA256

90bf2e24fd9833156245d54996fa06dcdb2dc2a1465852249728fa78d2554035
SHA512

f85a941bd3973be4fd6ac48f37c3329432bae05862315d30f2b96dd8c5ca205d123b4204e40228e42e0b1caa773ada5b86434bb877faebd57ab1bfca932fc68c
SSDEEP

192:+bScNHeYGly68CHG26LC5uZrp3hUWDE82QWna:+b/NHefly6ZCLC4rp3hUWDE82QWa

Score

10^/10

persistence

Modifies WinLogon for persistence 2 TTPs 1 IoCs

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe,service.exe"	rundll32.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

System Information Discovery

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28
PID 1056 wrote to memory of 1040	1056	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7c948ea1cc9c30c94a2068b6881d1c_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3b7c948ea1cc9c30c94a2068b6881d1c_JaffaCakes118.dll,#1
  2⤵
  - Modifies WinLogon for persistence
  - Enumerates connected drives
  PID:1040