908288f90e4d8c82673b1c82b58448aa8efead2da3e820450048d6cd6f29af27

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-07-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll
Size

64KB
MD5

5e56d01a83603db059465543596fbd2e
SHA1

72dc71efbe52ae217652ed2bdae0dda0566cfffb
SHA256

908288f90e4d8c82673b1c82b58448aa8efead2da3e820450048d6cd6f29af27
SHA512

7673c186c917d0a1c1a3cd4d2c329beacc4003a7e78907804360eff6a611f9f95057e91f7c7475082e1e7b7b34099571133c4b04af1b9a1a5f30d907f54cd6a6
SSDEEP

1536:lJSnE61XjpgLgIannJu67Y42FSa0k/sV/bcy5:lOXNgLV67Y4aBatcy5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-1-0x0000000010000000-0x0000000010029000-memory.dmp	upx
behavioral1/memory/2224-0-0x0000000010000000-0x0000000010029000-memory.dmp	upx
behavioral1/memory/2224-4-0x0000000010000000-0x0000000010029000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31
PID 2308 wrote to memory of 2224	2308	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-1-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2224-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/2224-2-0x00000000002F0000-0x00000000002FA000-memory.dmp

Filesize
40KB

Download
memory/2224-3-0x0000000074982000-0x0000000074996000-memory.dmp

Filesize
80KB

Download
memory/2224-4-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download