908288f90e4d8c82673b1c82b58448aa8efead2da3e820450048d6cd6f29af27

General

Target

5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll
Size

64KB
MD5

5e56d01a83603db059465543596fbd2e
SHA1

72dc71efbe52ae217652ed2bdae0dda0566cfffb
SHA256

908288f90e4d8c82673b1c82b58448aa8efead2da3e820450048d6cd6f29af27
SHA512

7673c186c917d0a1c1a3cd4d2c329beacc4003a7e78907804360eff6a611f9f95057e91f7c7475082e1e7b7b34099571133c4b04af1b9a1a5f30d907f54cd6a6
SSDEEP

1536:lJSnE61XjpgLgIannJu67Y42FSa0k/sV/bcy5:lOXNgLV67Y4aBatcy5

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/740-0-0x0000000010000000-0x0000000010029000-memory.dmp	upx
behavioral2/memory/740-31-0x0000000010000000-0x0000000010029000-memory.dmp	upx

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	rundll32.exe
File opened (read-only)	\??\M:	rundll32.exe
File opened (read-only)	\??\Y:	rundll32.exe
File opened (read-only)	\??\G:	rundll32.exe
File opened (read-only)	\??\H:	rundll32.exe
File opened (read-only)	\??\I:	rundll32.exe
File opened (read-only)	\??\X:	rundll32.exe
File opened (read-only)	\??\E:	rundll32.exe
File opened (read-only)	\??\R:	rundll32.exe
File opened (read-only)	\??\S:	rundll32.exe
File opened (read-only)	\??\P:	rundll32.exe
File opened (read-only)	\??\T:	rundll32.exe
File opened (read-only)	\??\U:	rundll32.exe
File opened (read-only)	\??\W:	rundll32.exe
File opened (read-only)	\??\Z:	rundll32.exe
File opened (read-only)	\??\L:	rundll32.exe
File opened (read-only)	\??\N:	rundll32.exe
File opened (read-only)	\??\O:	rundll32.exe
File opened (read-only)	\??\J:	rundll32.exe
File opened (read-only)	\??\Q:	rundll32.exe
File opened (read-only)	\??\V:	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 740	4140	rundll32.exe	84
PID 4140 wrote to memory of 740	4140	rundll32.exe	84
PID 4140 wrote to memory of 740	4140	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\5e56d01a83603db059465543596fbd2e_JaffaCakes118.dll,#1
  2⤵
  - Enumerates connected drives
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-0-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/740-1-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-2-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-3-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-4-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-5-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-6-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-10-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-9-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-8-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-21-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-20-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-19-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-18-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-17-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-16-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-15-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-14-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-13-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-12-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-11-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-7-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-24-0x0000000003330000-0x0000000003340000-memory.dmp

Filesize
64KB

Download
memory/740-23-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-22-0x0000000003290000-0x00000000032A0000-memory.dmp

Filesize
64KB

Download
memory/740-25-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-27-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-26-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-28-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-29-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-30-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-31-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/740-33-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-32-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/740-34-0x0000000003330000-0x0000000003333000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing