Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12/07/2024, 18:23
Behavioral task
behavioral1
Sample
3e64bfbd6eb36214c45a1dd73495b9c5_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
3e64bfbd6eb36214c45a1dd73495b9c5_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
3e64bfbd6eb36214c45a1dd73495b9c5_JaffaCakes118.dll
-
Size
22KB
-
MD5
3e64bfbd6eb36214c45a1dd73495b9c5
-
SHA1
679e966f33c7339497891b7994320d9e77fa4716
-
SHA256
b7c95b941e7783a496a799d21e55674a5b4957e14772ad1ed1b67f3b0254b3f0
-
SHA512
13e2a4153040bda27dd0dcc866c3e8a4540e4a6a392b9d3c4510317cbfe3afcdd22394e19265687742ae4518c9965a4259fb06341977c65cdbea25111af227aa
-
SSDEEP
384:UyavKBYPM/wpyHy4pYYZfXZuAgsznib8z0wwzR7cbhYU6vvgyghUGRrI:UyppuXuZuAg1bImJcu7S1O
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 3 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\ rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications rundll32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\rundll32.exe = "C:\\Windows\\SysWOW64\\rundll32.exe:*:Enabled:explorer" rundll32.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\pcixm.sys rundll32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\pcixm.sys\ = "Driver" rundll32.exe -
resource yara_rule behavioral2/memory/3168-0-0x0000000010000000-0x000000001003B000-memory.dmp upx behavioral2/memory/3168-1-0x0000000010000000-0x000000001003B000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hrpdcf.bin rundll32.exe -
Suspicious behavior: LoadsDriver 64 IoCs
pid Process 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe 3168 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3524 wrote to memory of 3168 3524 rundll32.exe 84 PID 3524 wrote to memory of 3168 3524 rundll32.exe 84 PID 3524 wrote to memory of 3168 3524 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64bfbd6eb36214c45a1dd73495b9c5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3e64bfbd6eb36214c45a1dd73495b9c5_JaffaCakes118.dll,#12⤵
- Modifies firewall policy service
- Impair Defenses: Safe Mode Boot
- Drops file in System32 directory
- Suspicious behavior: LoadsDriver
PID:3168
-