Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2024, 11:17
Static task
static1
Behavioral task
behavioral1
Sample
a6925f4e17b512fb7a7b8b0e0cec5293_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a6925f4e17b512fb7a7b8b0e0cec5293_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a6925f4e17b512fb7a7b8b0e0cec5293_JaffaCakes118.dll
-
Size
252KB
-
MD5
a6925f4e17b512fb7a7b8b0e0cec5293
-
SHA1
c03aa8b6e756e82eb039b8cd05e90b9a867dd023
-
SHA256
04ea7a57c741695131c4c5fd16d607a64a7ec034bcb7b557b84eb2ee56102c71
-
SHA512
bba5f7cfe55ae6564ab1be2a828b6ef43d4a2f6a6047b11c186e9b561e43d7e84e2aacf0bb830283e6d45d90cea1620a7ce1285b1b3d2373fbc413d47da8e3da
-
SSDEEP
3072:H2nc8Ofx1MbxTaamX4uCanKGGlk6N8EKxDDFHDH+kwoA6YbwWWuVZwmfbGly4jtT:igJwoBi3XbGly4j83Hzm
Malware Config
Signatures
-
Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\axrfgvek = "{D3700B05-6AD4-4625-AA5E-0C7CBE6EE66E}" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3700B05-6AD4-4625-AA5E-0C7CBE6EE66E} rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3700B05-6AD4-4625-AA5E-0C7CBE6EE66E}\InProcServer32\ = "C:\\Windows\\axrfgvek.dll" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D3700B05-6AD4-4625-AA5E-0C7CBE6EE66E}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3788 wrote to memory of 4264 3788 rundll32.exe 84 PID 3788 wrote to memory of 4264 3788 rundll32.exe 84 PID 3788 wrote to memory of 4264 3788 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6925f4e17b512fb7a7b8b0e0cec5293_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6925f4e17b512fb7a7b8b0e0cec5293_JaffaCakes118.dll,#12⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4264
-