Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 06:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ced6014ea824b17be1bc3690bdc366fd_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ced6014ea824b17be1bc3690bdc366fd_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ced6014ea824b17be1bc3690bdc366fd_JaffaCakes118.dll
-
Size
26KB
-
MD5
ced6014ea824b17be1bc3690bdc366fd
-
SHA1
cf3c8f76980eefa8c9ccff69604ca2b9b451dfa3
-
SHA256
92ecfc970df2bbb96dc8ba71830cbbd88f8bc79a338a7879613e97b52f38774b
-
SHA512
92b89db043cdbebb67e9eb36c2d411af2810a26b1ef46bb24e60c4dce70d6869f84bd7112b84ae3653c9e8ddeb4a8655f1837808d92132079e9fba8cc167fa98
-
SSDEEP
384:w2aXe03Izp+isy+/1IhNi7p6i/cP0kIrQXT4E70UhsGKxosXtKH1MF6sV+yJRn:w2+/rySektmTD4E7RsGtsXtt4sVdJRn
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3260 rundll32.exe -
Modifies WinLogon 2 TTPs 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Asynchronous = "1" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Impersonate = "0" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Logon = "B" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Asynchronous = "1" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\DllName = "C:\\Windows\\system32\\__c00D333A.dat" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\DllName = "C:\\Windows\\system32\\__c00D333A.dat" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Startup = "B" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c00D333A\Logon = "B" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\__c00D333A.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\__c00D333A.dat rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2980 2636 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2636 rundll32.exe 2636 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe 3260 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1804 wrote to memory of 2636 1804 rundll32.exe 83 PID 1804 wrote to memory of 2636 1804 rundll32.exe 83 PID 1804 wrote to memory of 2636 1804 rundll32.exe 83 PID 2636 wrote to memory of 3260 2636 rundll32.exe 84 PID 2636 wrote to memory of 3260 2636 rundll32.exe 84 PID 2636 wrote to memory of 3260 2636 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ced6014ea824b17be1bc3690bdc366fd_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ced6014ea824b17be1bc3690bdc366fd_JaffaCakes118.dll,#12⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\__c00D333A.dat",B3⤵
- Loads dropped DLL
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 6403⤵
- Program crash
PID:2980
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2636 -ip 26361⤵PID:4876
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
26KB
MD5ced6014ea824b17be1bc3690bdc366fd
SHA1cf3c8f76980eefa8c9ccff69604ca2b9b451dfa3
SHA25692ecfc970df2bbb96dc8ba71830cbbd88f8bc79a338a7879613e97b52f38774b
SHA51292b89db043cdbebb67e9eb36c2d411af2810a26b1ef46bb24e60c4dce70d6869f84bd7112b84ae3653c9e8ddeb4a8655f1837808d92132079e9fba8cc167fa98