Analysis

  • max time kernel
    133s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/08/2024, 19:52

General

  • Target

    b4cf6e5b9d514f874c79ebb84b107d8a_JaffaCakes118.dll

  • Size

    152KB

  • MD5

    b4cf6e5b9d514f874c79ebb84b107d8a

  • SHA1

    822760a30f2a85559226774c2d12bc01c03eca8b

  • SHA256

    982fb703fdf69cce55afd0ca09e137c75a7d2e9cb4f4618c5ab2affad69e3264

  • SHA512

    abcd923aa972dd72f054b8ff4970e353aa6fee79b7ceeeffa07865dd4a0cd0001616462c25b0db79116c044764c2db24e26ab9b1100467790eb59752e6e18ec7

  • SSDEEP

    3072:RD396xhMaKzde+WYHN7bIBV7WBUEd7CfzZxUFU:dEMaK5e+Wa7bIBVaBUk2ZxU

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cf6e5b9d514f874c79ebb84b107d8a_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3332
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\b4cf6e5b9d514f874c79ebb84b107d8a_JaffaCakes118.dll,#1
      2⤵
      • Blocklisted process makes network request
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/5080-1-0x0000000010000000-0x0000000010020000-memory.dmp

    Filesize

    128KB

  • memory/5080-2-0x0000000010000000-0x000000001002C000-memory.dmp

    Filesize

    176KB