Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 23:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe
-
Size
48KB
-
MD5
b97bd7f868b3d7ad4d060d8fac8b20c7
-
SHA1
521e2c205954ea72a4f3375c1dc804354de732c0
-
SHA256
6831f0a18cb319f3196b221f9b2ae4315ad0e2cca96cfd8e2bf2ce814733a0b6
-
SHA512
7b8ea9a71e3005268a0d57e2a9f42338b53d74423984197263da8b49469c8bcb7d7061d5d222a9c8f924fd74d2c4630b76bde09246c180f79c6be195993ea55d
-
SSDEEP
768:6YFZpAm2k9tywikprrq12ynXvUF+6a6LsqEev0HPs2krh8wJ44rOg0:6Ypntukp6omfUFw65EeMvWewa4
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 2748 rundll32.exe 2772 rundll32.exe -
Modifies WinLogon 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\DllName = "C:\\Windows\\system32\\__c0092CB9.dat" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Impersonate = "0" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Logon = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9 rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Asynchronous = "1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\DllName = "C:\\Windows\\system32\\__c0092CB9.dat" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Logon = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0092CB9\Asynchronous = "1" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\__c0092CB9.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\__c0092CB9.dat rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2748 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe 2772 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2684 wrote to memory of 2748 2684 b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe 30 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31 PID 2748 wrote to memory of 2772 2748 rundll32.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\b97bd7f868b3d7ad4d060d8fac8b20c7_JaffaCakes118.exe.dat",E2⤵
- Loads dropped DLL
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\__c0092CB9.dat",B3⤵
- Loads dropped DLL
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2772
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5676145c8d44359b68b55ce05bf3549bb
SHA1c0aebac114735d5b08a1644936406201454356c1
SHA256a7b4c9d6d58738fd47697e33fd7745f37f0fe4d1332a6de24f589631fcd9e634
SHA512501e1d7eb716132e3db49a79877910cb58443a7d51562a0ca41e4ad71bbc2809eac064479abf21aa937fd0b7f0a86b688b9fa536851c0bb68e0261f93411479d