266539196eccaba381194fbfbb7b30fd27846f87d8cf132bf5ff6771768ef76e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 16:50

Target

706e5d282694bba6455c2b3af19f94c9_JaffaCakes118.dll
Size

24KB
MD5

706e5d282694bba6455c2b3af19f94c9
SHA1

0c99737b285223c24b859c0fc31e511c49da6aeb
SHA256

266539196eccaba381194fbfbb7b30fd27846f87d8cf132bf5ff6771768ef76e
SHA512

90475c3530d810fdfb2ce9d7ef5500d9838819ee9ca52fd4528bc4d2427608cf47cd3520504bf775550a305dc979e35b65ee5304ec32b460975e053c9bddcdb5
SSDEEP

384:c2DqZrstv3VTAWPuh+rRS7BMUnXxRByn1nyxZqOO9BAYQjTdWTG2MGPXvMRndzJg:StkdDGhqR4nh2nZcQjmTdiBxsRdzp4

Score

10^/10

Modifies firewall policy service 3 TTPs 1 IoCs

evasion

Modify Registry

Windows Service

Disable or Modify System Firewall

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	rundll32.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
behavioral2/memory/4764-0-0x0000000010000000-0x0000000010012000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACADABAF-1000-0010-8000-10AA006D2EA4}\InProcServer32\ = "C:\\Windows\\system32\\system.dat"	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4764	4848	rundll32.exe	84
PID 4848 wrote to memory of 4764	4848	rundll32.exe	84
PID 4848 wrote to memory of 4764	4848	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\706e5d282694bba6455c2b3af19f94c9_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\706e5d282694bba6455c2b3af19f94c9_JaffaCakes118.dll,#1
  2⤵
  - Modifies firewall policy service
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4764