Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-09-2024 10:16
Behavioral task
behavioral1
Sample
da20e987a200f9e94112d989caff5f3d_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
da20e987a200f9e94112d989caff5f3d_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
da20e987a200f9e94112d989caff5f3d_JaffaCakes118.dll
-
Size
22KB
-
MD5
da20e987a200f9e94112d989caff5f3d
-
SHA1
0867d3f794d4f6d139590460628a3f7a20ff1b84
-
SHA256
ddfb7ace775d7851531ee57d63efe1fab85b574e1d46d86932a3aa080a639399
-
SHA512
47a5de5415016a369178e3c72acb99bb5f03ac321f2ac461cf759ae9bbd0e2395ea4b80c736025fa3eb616236fc4d2125d2bdad739be25109510091644f32a7b
-
SSDEEP
384:AF06DEvaF7Oazr204JGv49wqc+0EUKc0mUXW1/4XdIKL9nn0k1jN72x:A06IvJUr2046ZqkEUKc0mUQWdxn0k15q
Score
8/10
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ufad-dns60\Parameters\ServiceDll = "C:\\Windows\\system32\\hYmuGAAhsyW.dll" regsvr32.exe -
resource yara_rule behavioral1/memory/2016-0-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral1/memory/1844-1-0x0000000010000000-0x0000000010015000-memory.dmp upx behavioral1/memory/1844-2-0x0000000010000000-0x0000000010015000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\hYmuGAAhsyW.dll regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2016 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2016 regsvr32.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe Token: SeDebugPrivilege 1844 svchost.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30 PID 2056 wrote to memory of 2016 2056 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\da20e987a200f9e94112d989caff5f3d_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\da20e987a200f9e94112d989caff5f3d_JaffaCakes118.dll2⤵
- Server Software Component: Terminal Services DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
PID:2016
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k ufad-dns601⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1844