Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
14/07/2024, 11:23
Behavioral task
behavioral1
Sample
4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll
-
Size
122KB
-
MD5
4599eb5450b1a4e373aa5cdd08420245
-
SHA1
c91c8aa0fa440d2c6fefc14ae176ca11c75f1320
-
SHA256
e1ffa36c0246bbb8cd8272e56c4c0adba7fea85dc47c70bd76d57bbb087e7fd4
-
SHA512
124fdca6e91f49497e477d0fa5196cb1b70f165041a1da25853e6eac96ec9348acce167ffb0b43fb7c488aa02b3a062bd2ed3258470485a171347bc4604297f8
-
SSDEEP
1536:8tubDUw3lbQ0zTjb6CuI/CI+33gmv4YZSAjbqsbxI5yXnouy8dROQ:YcwooH33gmJb7tIyoutDOQ
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 4284 rundll32.exe -
resource yara_rule behavioral2/memory/4544-0-0x0000000010000000-0x0000000010020000-memory.dmp upx behavioral2/files/0x0009000000023471-4.dat upx behavioral2/memory/4544-6-0x0000000010000000-0x0000000010020000-memory.dmp upx behavioral2/memory/4284-7-0x0000000010000000-0x0000000010020000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\mspime.dll rundll32.exe File opened for modification C:\Windows\mspime.dll rundll32.exe File opened for modification C:\Windows\lua.wkl rundll32.exe File opened for modification C:\Windows\lua.wkl rundll32.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 4284 rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll,1312254664,1947795251,-352895392" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe 4284 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3184 wrote to memory of 4544 3184 rundll32.exe 83 PID 3184 wrote to memory of 4544 3184 rundll32.exe 83 PID 3184 wrote to memory of 4544 3184 rundll32.exe 83 PID 4544 wrote to memory of 4284 4544 rundll32.exe 87 PID 4544 wrote to memory of 4284 4544 rundll32.exe 87 PID 4544 wrote to memory of 4284 4544 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4599eb5450b1a4e373aa5cdd08420245_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\mspime.dll",_RunAs@163⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Access Token Manipulation: Create Process with Token
- Suspicious behavior: EnumeratesProcesses
PID:4284
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
122KB
MD54599eb5450b1a4e373aa5cdd08420245
SHA1c91c8aa0fa440d2c6fefc14ae176ca11c75f1320
SHA256e1ffa36c0246bbb8cd8272e56c4c0adba7fea85dc47c70bd76d57bbb087e7fd4
SHA512124fdca6e91f49497e477d0fa5196cb1b70f165041a1da25853e6eac96ec9348acce167ffb0b43fb7c488aa02b3a062bd2ed3258470485a171347bc4604297f8