Analysis
-
max time kernel
137s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21-08-2024 19:34
Static task
static1
Behavioral task
behavioral1
Sample
b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll
-
Size
678KB
-
MD5
b4c1769130661d0bdfd97da5cdc48dfd
-
SHA1
9efbce6293ac36086ad53acf375c5ed1a857f01b
-
SHA256
7bd032519786e19b7da359d254da990a5734298bbea584a42bd7c0713b005a77
-
SHA512
9b04704cc1e0b6625baeae10196d5d63665bec6829291300db59b92b5a67803f452a5e4346b3a5fd39732e7419acf3426aef7898c0039cf577ef08270f8e1f12
-
SSDEEP
12288:a4hUaFty+yr+Ts4e3kmYn0YaAsPko8dhM5wzTrr5v3Q2KWHQR:abaFty+yr+Ts4e3kmYn0YaAsB+M5STru
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Cryptographic Services\Parameters\ServiceDll = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll" rundll32.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1792 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1996 rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 484 wrote to memory of 1996 484 rundll32.exe 31 PID 1996 wrote to memory of 1772 1996 rundll32.exe 33 PID 1996 wrote to memory of 1772 1996 rundll32.exe 33 PID 1996 wrote to memory of 1772 1996 rundll32.exe 33 PID 1996 wrote to memory of 1772 1996 rundll32.exe 33 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34 PID 2104 wrote to memory of 1792 2104 svchost.exe 34
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:484 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b4c1769130661d0bdfd97da5cdc48dfd_JaffaCakes118.dll,#12⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del "C:\Windows\SysWOW64\rundll32.exe" > nul3⤵
- System Location Discovery: System Language Discovery
PID:1772
-
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k "Cryptographic Services"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe c:\users\admin\appdata\local\temp\b4c1769130661d0bdfd97da5cdc48dfd_jaffacakes118.dll, Launch2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1792
-