Analysis
-
max time kernel
150s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12-09-2024 23:01
Behavioral task
behavioral1
Sample
dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll
-
Size
34KB
-
MD5
dd33a8b54a24871ac1fed50ba61f5f8b
-
SHA1
a424a050fa43cdba0159bde9435fbd32e7c10e7e
-
SHA256
aac52498edc951858affe113cae0d3bb0748cd00d5f061ff29b679edacf3a5e7
-
SHA512
5429ea17807c76dc43e713c00874da9488f592dfe687e2301321b08ad4c2092a73ecc7739f90d7356a7505aa042a51f1b6c31caa600d09a366ff4b1c9f3cedbe
-
SSDEEP
768:MgeUxHpbt4Vw3N0e2YkDVjK4trS2x7SoI/9WOBw61PafhCnbcuyD7UAfa:MxUHt4Vwd0nYSZJko6FC4nouy8Afa
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000900000001e557-4.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 1044 rundll32.exe -
resource yara_rule behavioral2/memory/4664-0-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/files/0x000900000001e557-4.dat upx behavioral2/memory/1044-6-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/4664-7-0x0000000010000000-0x000000001001E000-memory.dmp upx behavioral2/memory/1044-9-0x0000000010000000-0x000000001001E000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\msisue.dll rundll32.exe File created C:\Windows\msisue.dll rundll32.exe -
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 1044 rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6}\{F69EB73C-700A-42c9-8F9D-E8C4ABC27EF3} = "dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll,1314612079,-85730467,-1814625877" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32 rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B3AC3FA-B695-41b6-BAA0-860EB5EB6FD6} rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe 1044 rundll32.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2196 wrote to memory of 4664 2196 rundll32.exe 83 PID 2196 wrote to memory of 4664 2196 rundll32.exe 83 PID 2196 wrote to memory of 4664 2196 rundll32.exe 83 PID 4664 wrote to memory of 1044 4664 rundll32.exe 87 PID 4664 wrote to memory of 1044 4664 rundll32.exe 87 PID 4664 wrote to memory of 1044 4664 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd33a8b54a24871ac1fed50ba61f5f8b_JaffaCakes118.dll,#12⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\rundll32.exerundll32 "C:\Windows\msisue.dll",_RunAs@163⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Access Token Manipulation: Create Process with Token
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5dd33a8b54a24871ac1fed50ba61f5f8b
SHA1a424a050fa43cdba0159bde9435fbd32e7c10e7e
SHA256aac52498edc951858affe113cae0d3bb0748cd00d5f061ff29b679edacf3a5e7
SHA5125429ea17807c76dc43e713c00874da9488f592dfe687e2301321b08ad4c2092a73ecc7739f90d7356a7505aa042a51f1b6c31caa600d09a366ff4b1c9f3cedbe