Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07-09-2024 04:33
Static task
static1
Behavioral task
behavioral1
Sample
d115552252592f589e7412d6650a949e_JaffaCakes118.js
Resource
win7-20240729-en
General
-
Target
d115552252592f589e7412d6650a949e_JaffaCakes118.js
-
Size
1.0MB
-
MD5
d115552252592f589e7412d6650a949e
-
SHA1
ad4c6cd7e85541866f5cd0fa747b7f08a5fe8067
-
SHA256
3b55010b7f8f4e7ded435b29af5d00f98c06dd8f14258355d0049f186f4a6bbc
-
SHA512
461aebb7a488102e3de0c9b807dbf8d04a41737d050dc4ca95bbf8283ee5176845adafee6bf81db83a73af2b67e66f45adaad6a145062ae035208cee71adfa71
-
SSDEEP
1536:toTXaFN5VEYPznC2x1ZQu56WD/EYc9piGqvzlY84fEgZt32a2zO70tsE+TXURbtj:tS2uXtlk
Malware Config
Extracted
danabot
164.175.70.152
89.144.25.243
86.177.194.155
29.195.96.191
29.43.1.29
84.215.94.117
115.58.63.174
89.144.25.104
199.179.34.46
68.48.87.153
Signatures
-
Danabot x86 payload 1 IoCs
Detection of Danabot x86 payload, mapped in memory during the execution of its loader.
resource yara_rule behavioral1/files/0x0006000000019246-1.dat family_danabot -
Blocklisted process makes network request 8 IoCs
flow pid Process 2 2796 rundll32.exe 5 2796 rundll32.exe 6 2796 rundll32.exe 9 2796 rundll32.exe 10 2796 rundll32.exe 13 2796 rundll32.exe 16 2796 rundll32.exe 17 2796 rundll32.exe -
Loads dropped DLL 5 IoCs
pid Process 2696 regsvr32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe 2796 rundll32.exe -
Command and Scripting Interpreter: JavaScript 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2988 2324 wscript.exe 30 PID 2324 wrote to memory of 2988 2324 wscript.exe 30 PID 2324 wrote to memory of 2988 2324 wscript.exe 30 PID 2324 wrote to memory of 2988 2324 wscript.exe 30 PID 2324 wrote to memory of 2988 2324 wscript.exe 30 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2988 wrote to memory of 2696 2988 regsvr32.exe 31 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32 PID 2696 wrote to memory of 2796 2696 regsvr32.exe 32
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\d115552252592f589e7412d6650a949e_JaffaCakes118.js1⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll2⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\regsvr32.exe-s C:\Users\Admin\AppData\Local\Temp\\ALNYajCWUsjV.dll3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\ALNYajCWUsjV.dll,f04⤵
- Blocklisted process makes network request
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2796
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
284KB
MD582e719eae0182374cb433118d8d802d2
SHA1626ba0208fcf1ef29bf8cfa0e6f70ded70aee885
SHA2568e0dcdd85ab03fd0230f512158aaee86a29b6816c959bfd4ae6a91500f37e45c
SHA512914370240040c3ee6bc328a8c93b8a00ab20af44ac98222626ecee907bfe18a1e856f6b4a07c75073a40abd4b2caac042b9f92b7f3f774700cbfb5998ba8e968