Overview

overview

10

Static

static

7

d424211490...18.dll

windows7-x64

10

d424211490...18.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    134s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2024, 10:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d4242114901a7047ccc98a10f98ba42c_JaffaCakes118.dll

  • Size

    151KB

  • MD5

    d4242114901a7047ccc98a10f98ba42c

  • SHA1

    f2abc95a3df2bb1c5e89336f1357240f7fdaeebf

  • SHA256

    fe4911e8f78af15bfad1cb471bce47f02bb4e1065893ae6c052c6fa0195b0980

  • SHA512

    61ebc4cc04302954690962ea95d0123ed5b0a69720428ceb93c4ed1210c2db15e22a17a8b0f7bd170d51ca363f537710f86df9aac2285082623461ab877ace51

  • SSDEEP

    3072:MeVMCjJh5oWdf2/aPlQSY5u1lJZGX2yMMpS53W2eR4q3ofxkoAb:MeK+hei2/atQSvPZm2RFq45kom

Score
10/10
discoveryevasionupx

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 32 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of UnmapMainImage
    PID:3568
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4242114901a7047ccc98a10f98ba42c_JaffaCakes118.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:224
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\d4242114901a7047ccc98a10f98ba42c_JaffaCakes118.dll,#1
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4036
        • C:\Windows\SysWOW64\explorer.exe
          explorer C:\Users\Admin\AppData
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4612
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:1928
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1864
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1284,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
      1⤵
        PID:2628

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/4036-0-0x0000000010000000-0x000000001001A000-memory.dmp

        Filesize

        104KB

        Download

      • memory/4036-2-0x00000000014A0000-0x00000000014C1000-memory.dmp

        Filesize

        132KB

        Download

      • memory/4036-5-0x00000000014A0000-0x00000000014C1000-memory.dmp

        Filesize

        132KB

        Download

      • memory/4036-9-0x000000007F940000-0x000000007F941000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4036-7-0x00000000014A0000-0x00000000014C1000-memory.dmp

        Filesize

        132KB

        Download

      • memory/4036-8-0x0000000077C82000-0x0000000077C83000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4036-6-0x00000000014A0000-0x00000000014C1000-memory.dmp

        Filesize

        132KB

        Download

      • memory/4036-11-0x0000000010000000-0x000000001001A000-memory.dmp

        Filesize

        104KB

        Download