Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
15/07/2024, 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe
-
Size
48KB
-
MD5
47f0f840fc693aaffaf9f7e683990f65
-
SHA1
d4e3d61709739e07653be4cf3b67ebc1fc7dc52d
-
SHA256
b1081c66b230ec4dd739005021dfb2d0a1dda1acdc6692453ab0e98342657029
-
SHA512
36c032722a12ca8199f32cd618cecbe5b258cc9810ea702bf4b103b710b64ce82844d1a972e39225a6d90bbe05e60eb7033f5fd7750750d937799b64b2667843
-
SSDEEP
768:E0699fnwTA0EAcJxnlYEgFegP4JtGfihzziiKcnw9shSLrIpJKZa:MGWJxnKXFrgJtGa1eiLw9j8pkZa
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 1872 rundll32.exe 1704 rundll32.exe -
Modifies WinLogon 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\DllName = "C:\\Windows\\system32\\__c0025CB1.dat" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Impersonate = "0" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Asynchronous = "1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\DllName = "C:\\Windows\\system32\\__c0025CB1.dat" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Asynchronous = "1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Logon = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0025CB1\Logon = "B" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\__c0025CB1.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\__c0025CB1.dat rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1872 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe 1704 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 2524 wrote to memory of 1872 2524 47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe 30 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31 PID 1872 wrote to memory of 1704 1872 rundll32.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\47f0f840fc693aaffaf9f7e683990f65_JaffaCakes118.exe.dat",E2⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\__c0025CB1.dat",B3⤵
- Loads dropped DLL
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:1704
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD5254e736463add1ddec5111e4a90cbdd9
SHA1845aea321e6cbdff3901b005b2d5049b6253b08f
SHA25645766bd5e858296a43870facecc8e4e3af65bc928ca3ea797bb23462d6cd5810
SHA512e5a57e7bd5c798d49880a7b291bd9c9cae87543ef312ef6fc2d3e20393146843f928d77b4b8965c4aa025c781aee0f90648992977e428c35efd88b68fcf297d2