Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
22/08/2024, 23:38
Behavioral task
behavioral1
Sample
b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll
-
Size
38KB
-
MD5
b984439cbe68d09348b8385ef4435f3f
-
SHA1
c6c23a137c38194ee6ee9b3ff7dbb2e3a4c4b073
-
SHA256
5715b50d0d1588ca32116b10eda0afb687ead513c5723691c8a8aac8f3614523
-
SHA512
3580a385eff9f19d3f015745a18a78bb3df7a4324bb807fcd39b4bd39a4300529ab938310e5d85d8f1ebb6dcec0797dbc6a39ef76eb29eebff711e8a009dd707
-
SSDEEP
768:q72EtfWfm+ZgTlShj1dESUOpP7KqjHEMc72pUnbcuyD7Ut:qSMfWOMQPSP2mH1ciUnouy8t
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x00090000000120f1-4.dat acprotect -
resource yara_rule behavioral1/memory/2140-0-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/files/0x00090000000120f1-4.dat upx behavioral1/memory/2680-5-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/memory/2680-6-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/memory/2140-7-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/memory/2680-8-0x0000000010000000-0x0000000010022000-memory.dmp upx behavioral1/memory/2680-12-0x0000000010000000-0x0000000010022000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\lua.wkl rundll32.exe File created C:\Windows\msremotx.dll rundll32.exe File opened for modification C:\Windows\msremotx.dll rundll32.exe File opened for modification C:\Windows\lua.wkl rundll32.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 2680 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll,1309250235,-496657352,-352895392" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe 2680 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 756 wrote to memory of 2140 756 rundll32.exe 30 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31 PID 2140 wrote to memory of 2680 2140 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b984439cbe68d09348b8385ef4435f3f_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\msremotx.dll",_RunAs@163⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2680
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5b984439cbe68d09348b8385ef4435f3f
SHA1c6c23a137c38194ee6ee9b3ff7dbb2e3a4c4b073
SHA2565715b50d0d1588ca32116b10eda0afb687ead513c5723691c8a8aac8f3614523
SHA5123580a385eff9f19d3f015745a18a78bb3df7a4324bb807fcd39b4bd39a4300529ab938310e5d85d8f1ebb6dcec0797dbc6a39ef76eb29eebff711e8a009dd707