Analysis
-
max time kernel
92s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
15/07/2024, 16:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll
Resource
win10v2004-20240709-en
3 signatures
150 seconds
General
-
Target
4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll
-
Size
14KB
-
MD5
4a7eacc3075a5fd54d738a1bc5226dbd
-
SHA1
8feb5ed2d0664376289c4bc7472252dba31e968c
-
SHA256
60e19a8c8eb582c8eaf3c3d099b3291cdc345db1440036758ae32ce125baa6cd
-
SHA512
c08d21482d0d7e6a6e0626f162b439b0470997b331b0f18d99ef2ab4f63453af3f22d847217170d3f6391131e26b05596b027787135f11d7585e1c29951ab2a0
-
SSDEEP
192:d9DCPrUQBUP9ENhenY64DMdEMqHmN9pEMpz:dAgQmENhenY6GwPEM
Score
1/10
Malware Config
Signatures
-
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08E909A4-B236-48DD-8BCC-90A604B93E68}\InprocServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08E909A4-B236-48DD-8BCC-90A604B93E68} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08E909A4-B236-48DD-8BCC-90A604B93E68}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08E909A4-B236-48DD-8BCC-90A604B93E68}\InprocServer32\ThreadingModel = "Apartment" rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4548 rundll32.exe 4548 rundll32.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2856 wrote to memory of 4548 2856 rundll32.exe 83 PID 2856 wrote to memory of 4548 2856 rundll32.exe 83 PID 2856 wrote to memory of 4548 2856 rundll32.exe 83 PID 4548 wrote to memory of 3596 4548 rundll32.exe 56
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3596
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a7eacc3075a5fd54d738a1bc5226dbd_JaffaCakes118.dll,#13⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4548
-
-