a508647c8c316b67df3b30af9aadffed117cd2dddba161f5c4797af82ababe67

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-08-2024 00:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c76f92d5d4e6736f48e8e5243d4c38_JaffaCakes118.dll
Size

19KB
MD5

a4c76f92d5d4e6736f48e8e5243d4c38
SHA1

8fa83a7ad3a88b0511da999aafe9f9fc596a89f4
SHA256

a508647c8c316b67df3b30af9aadffed117cd2dddba161f5c4797af82ababe67
SHA512

92143d082b1f8c0db55a3601146bdddc50c40cc1e2134ff63cacb9d16b81c01cacece5a0286c456ef0a3e8c5525ca8b66429982f66eff7219c0d6ec346fc7480
SSDEEP

384:5cMQ9etx0YVyHUgdAWTpwiSfpjonmKCTp0II3kZSctJP:5cMQwBy0gCBpjomnTqV3yS6

Score

8^/10

discovery

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\beep.sys	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe
2832	rundll32.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2832	rundll32.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3704 wrote to memory of 2832	3704	rundll32.exe	84
PID 3704 wrote to memory of 2832	3704	rundll32.exe	84
PID 3704 wrote to memory of 2832	3704	rundll32.exe	84
PID 2832 wrote to memory of 3472	2832	rundll32.exe	56
PID 2832 wrote to memory of 3472	2832	rundll32.exe	56

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4c76f92d5d4e6736f48e8e5243d4c38_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a4c76f92d5d4e6736f48e8e5243d4c38_JaffaCakes118.dll,#1
    3⤵
    - Drops file in Drivers directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\datB229.tmp

Filesize
6KB

MD5
07462b728dec4edcbc56f8c3f2cf7f84

SHA1
d42b08dd15526f1657879f641d3d4783caf0e778

SHA256
b3fa24c919b682a840970109947cde354d2c2c8a7d70a7287f383ce143fd8ebb

SHA512
9f4a4eab164a183b38d12f8375ce7f32050e6ef61a05cb8186f217f4a493208d9fa73c8a6bb92767aa7ffd1ff5ea0354b1e4721d3f0d9a973a995b2a46143303

Download Submit
memory/2832-1-0x0000000010000000-0x000000001040E000-memory.dmp

Filesize
4.1MB

Download