2e1b657ed676d209fe27cf9c03f4cb040f9d2112f7e798b9c9aea2e5b37f1c69

Analysis

max time kernel
94s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48c7df99089edd824b427a9b1d00c017_JaffaCakes118.dll
Size

312KB
MD5

48c7df99089edd824b427a9b1d00c017
SHA1

a5a3c03e6ca29b39f5881f824cb1978379527d68
SHA256

2e1b657ed676d209fe27cf9c03f4cb040f9d2112f7e798b9c9aea2e5b37f1c69
SHA512

aa64bb938ea9d3f7bb3e3dad14697bac7df6e559007e8925f4bb8d018e1e077d03fa9970197761b0d4725f686e10f5a863f3ccf8fdbf9aa95aa2f10194e8f43d
SSDEEP

6144:xIeRrNHAYKIdFchQ6NnMdohq9HwCVRn+Q/ymBRNHQk:xzAYKwqNNMdohq9HwHkwk

Score

7^/10

vmprotect

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1176886754-713327781-2233697964-1000\Control Panel\International\Geo\Nation	rundll32.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral2/memory/1860-0-0x0000000000400000-0x00000000004A5000-memory.dmp	vmprotect

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32.dll	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 1860	1420	rundll32.exe	83
PID 1420 wrote to memory of 1860	1420	rundll32.exe	83
PID 1420 wrote to memory of 1860	1420	rundll32.exe	83
PID 1860 wrote to memory of 1592	1860	rundll32.exe	87
PID 1860 wrote to memory of 1592	1860	rundll32.exe	87
PID 1860 wrote to memory of 1592	1860	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c7df99089edd824b427a9b1d00c017_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\48c7df99089edd824b427a9b1d00c017_JaffaCakes118.dll,#1
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\DelEx.bat" "
    3⤵
    PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\DelEx.bat

Filesize
138B

MD5
9645f4a4f4d131d3cae739994abc63d6

SHA1
f982786ab95a8bbfd6cbfd34d7cfa9e8312d5053

SHA256
91e3dd407064922350c22320a284a377c83b67ec0cef2d15305ccd49d8ddb750

SHA512
a1b15cf6eb9a2714291f70f35046df2e026082f3fe4843d62ed86bc9e954b0cfe3b6a4847ffa408590b252b3d55c2753abf08443d40ea1882b82a8e3bded2167

Download Submit
memory/1860-0-0x0000000000400000-0x00000000004A5000-memory.dmp

Filesize
660KB

Download