Analysis
-
max time kernel
94s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
13/07/2024, 16:02
Behavioral task
behavioral1
Sample
4261cffac9008c632a27ac0d6404d998_JaffaCakes118.dll
Resource
win7-20240705-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
4261cffac9008c632a27ac0d6404d998_JaffaCakes118.dll
Resource
win10v2004-20240709-en
4 signatures
150 seconds
General
-
Target
4261cffac9008c632a27ac0d6404d998_JaffaCakes118.dll
-
Size
211KB
-
MD5
4261cffac9008c632a27ac0d6404d998
-
SHA1
51cf108d24bb9737272a864d4f21ebd5a347e37e
-
SHA256
be0c718fba2176ffbe9a8dd49459f93b70e10be19ae15b61e57374cfd9088527
-
SHA512
9b2b95bf7ed276e04916246f4ff56cde376ac91246a869f4fcc17f7eb7c0bf884c998a1f795e74162ffcc2328f560209c62954f2da074d7579c0015f4f9663ca
-
SSDEEP
6144:zs1XbJLF2tMe8Bvp2hdjE71O+ZjUzhNj:zgbJLFYMe++NE716h
Score
7/10
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/1536-0-0x0000000000400000-0x00000000004A6000-memory.dmp upx behavioral2/memory/1536-1-0x0000000000400000-0x00000000004A6000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1860 1536 WerFault.exe 83 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4584 wrote to memory of 1536 4584 rundll32.exe 83 PID 4584 wrote to memory of 1536 4584 rundll32.exe 83 PID 4584 wrote to memory of 1536 4584 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4261cffac9008c632a27ac0d6404d998_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4261cffac9008c632a27ac0d6404d998_JaffaCakes118.dll,#12⤵PID:1536
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 7923⤵
- Program crash
PID:1860
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1536 -ip 15361⤵PID:2768