ad055167a7590e97b6c122f0f73618a5a8277ad0bc2b6b69bb6164fe0aef170d

Analysis

max time kernel
150s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

c7f04f9b27479aee824ee52d65c59fbb_JaffaCakes118.dll
Size

26KB
MD5

c7f04f9b27479aee824ee52d65c59fbb
SHA1

a6f79d0e615e46c2cb73f1f23fd866fd0fb49d92
SHA256

ad055167a7590e97b6c122f0f73618a5a8277ad0bc2b6b69bb6164fe0aef170d
SHA512

7ab7ba25be53ad27a947d95d9e587b36f57dd5f628c8a890bc0e415e50066c1a152073b8310e80b64a44422994b24c407982260a9718eb8dd52badc4642e6ae1
SSDEEP

768:NlJbAWrCq90IkYkZ72pHggxs+WTbhofRvwnL:NlJbvWlYklQHgMsmCL

Score

7^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3280	rundll32.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\kxict.dll	rundll32.exe
File opened for modification	C:\Windows\kxict.dll	rundll32.exe

Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Create Process with Token

T1134.002

pid	Process
3280	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "c7f04f9b27479aee824ee52d65c59fbb_JaffaCakes118.dll,1291612044,1929285577,-1814625877"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe
3280	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 440	4560	rundll32.exe	87
PID 4560 wrote to memory of 440	4560	rundll32.exe	87
PID 4560 wrote to memory of 440	4560	rundll32.exe	87
PID 440 wrote to memory of 3280	440	rundll32.exe	90
PID 440 wrote to memory of 3280	440	rundll32.exe	90
PID 440 wrote to memory of 3280	440	rundll32.exe	90

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7f04f9b27479aee824ee52d65c59fbb_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c7f04f9b27479aee824ee52d65c59fbb_JaffaCakes118.dll,#1
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32 "C:\Windows\kxict.dll",_RunAs@16
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Access Token Manipulation: Create Process with Token
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Defense Evasion

Access Token Manipulation

T1134

Create Process with Token

T1134.002

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\kxict.dll

Filesize
26KB

MD5
c7f04f9b27479aee824ee52d65c59fbb

SHA1
a6f79d0e615e46c2cb73f1f23fd866fd0fb49d92

SHA256
ad055167a7590e97b6c122f0f73618a5a8277ad0bc2b6b69bb6164fe0aef170d

SHA512
7ab7ba25be53ad27a947d95d9e587b36f57dd5f628c8a890bc0e415e50066c1a152073b8310e80b64a44422994b24c407982260a9718eb8dd52badc4642e6ae1

Download Submit
memory/440-0-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/440-6-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/3280-5-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download
memory/3280-7-0x0000000010000000-0x000000001004E000-memory.dmp

Filesize
312KB

Download