6c915ba8fe53f393dee3269db8dcde5ac222f03a5b87afbee841f48e3c833416

Analysis

max time kernel
93s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
14/07/2024, 11:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

459bd4558d0fa0eb2516f5773a66bd6a_JaffaCakes118.dll
Size

9KB
MD5

459bd4558d0fa0eb2516f5773a66bd6a
SHA1

f708e3877052c8775fff654250c34cba8727c188
SHA256

6c915ba8fe53f393dee3269db8dcde5ac222f03a5b87afbee841f48e3c833416
SHA512

b16e7b9376e53eb3b1df9e359c104cc027f69939e76c55314096637dae2de0a4a34a65ca43ee161f6a49c15265c80182faf88c5d1aa7c330cc20b64d5634bb38
SSDEEP

192:hlUryh/0kYz5Rwxzm2qq17+gv9/9w9FHWY2h:hlUWDJqq17+gvZE

Score

8^/10

persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 668	1364	rundll32.exe	83
PID 1364 wrote to memory of 668	1364	rundll32.exe	83
PID 1364 wrote to memory of 668	1364	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\459bd4558d0fa0eb2516f5773a66bd6a_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\459bd4558d0fa0eb2516f5773a66bd6a_JaffaCakes118.dll,#1
  2⤵
  PID:668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Privilege Escalation

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads