2f367fdfe8cd5b90251bf9c74e33df4f9782b028cb545c9885ba7823a3924106

Analysis

max time kernel
150s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d1f369c64e041e2305538788c52c0b67_JaffaCakes118.dll
Size

33KB
MD5

d1f369c64e041e2305538788c52c0b67
SHA1

b6b09e75bd04c4a4b54bc8072eda524ffbee0aef
SHA256

2f367fdfe8cd5b90251bf9c74e33df4f9782b028cb545c9885ba7823a3924106
SHA512

39fc4cf99611fc171e0dc8611d8687052abf584dad29220be9d2d7f9e626c5dc6734d3d1fe3b92f1d79194ff0ba660681a6d7d43413effc1bfc055884d79eb2f
SSDEEP

768:hLdaBRsuszEez3B07sbev5PmSQo+0hUYv510neE:h52WzVk6imSQozWi2neE

Score

7^/10

discovery persistence

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
1328	rundll32.exe
1328	rundll32.exe
1236	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\awtutssr.dll,#1"	rundll32.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\awtutssr.dll	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\awtutssr.dll	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36D84C7E-CC68-4EB4-84DD-1C39F19F8937}\InprocServer32\ = "C:\\Windows\\SysWow64\\awtutssr.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36D84C7E-CC68-4EB4-84DD-1C39F19F8937}\InprocServer32\ThreadingModel = "Both"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36D84C7E-CC68-4EB4-84DD-1C39F19F8937}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{36D84C7E-CC68-4EB4-84DD-1C39F19F8937}\InprocServer32	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1328	rundll32.exe
1328	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe
1236	rundll32.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1328	rundll32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1328	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1328	1380	rundll32.exe	83
PID 1380 wrote to memory of 1328	1380	rundll32.exe	83
PID 1380 wrote to memory of 1328	1380	rundll32.exe	83
PID 1328 wrote to memory of 612	1328	rundll32.exe	5
PID 1328 wrote to memory of 1236	1328	rundll32.exe	90
PID 1328 wrote to memory of 1236	1328	rundll32.exe	90
PID 1328 wrote to memory of 1236	1328	rundll32.exe	90

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f369c64e041e2305538788c52c0b67_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f369c64e041e2305538788c52c0b67_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: RenamesItself
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Windows\system32\awtutssr.dll,a
    3⤵
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\awtutssr.dll

Filesize
33KB

MD5
d1f369c64e041e2305538788c52c0b67

SHA1
b6b09e75bd04c4a4b54bc8072eda524ffbee0aef

SHA256
2f367fdfe8cd5b90251bf9c74e33df4f9782b028cb545c9885ba7823a3924106

SHA512
39fc4cf99611fc171e0dc8611d8687052abf584dad29220be9d2d7f9e626c5dc6734d3d1fe3b92f1d79194ff0ba660681a6d7d43413effc1bfc055884d79eb2f

Download Submit
memory/1236-15-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1236-16-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1328-1-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1328-8-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1328-0-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1328-10-0x00000000028D0000-0x00000000028E0000-memory.dmp

Filesize
64KB

Download