Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system - submitted
14/09/2024, 00:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df23f0eaee937c1c5e5856e515255241_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
df23f0eaee937c1c5e5856e515255241_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target df23f0eaee937c1c5e5856e515255241_JaffaCakes118.dll
- Size 27KB
- Sample240914-aferysxckc
- SHA256 43583225526946e0e4102c2163bd3ef356844dc88d2ae25b6f70f937b708a709
- MD5 df23f0eaee937c1c5e5856e515255241
- SHA1 28d6f30c772528cb9055655fa24c499f854519db
- SHA512 2c46ce33111bc333fe93aa79e0f3fbf9ec3c444bbdab21a7a37c950451a95a9ce9d1c91a7e45f9da8ed6c582d91e2c322c25f697ab4b129846e84daa7a214e0c
- SSDEEP 384:H9VgrZ4l/3M+FeYF0wyXBabupgz+15oL6FtemZI/u2SPz/OGOo8j:H9VYu/35hvmCueqFtLS/cOXXj
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 2284 rundll32.exe 2284 rundll32.exe 1288 rundll32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\MSServer = "rundll32.exe C:\\Windows\\system32\\yayxywVP.dll,#1" rundll32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\yayxywVP.dll rundll32.exe File opened for modification C:\Windows\SysWOW64\yayxywVP.dll rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28220052-D9A9-44B1-AB98-EDC594D238B6} rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28220052-D9A9-44B1-AB98-EDC594D238B6}\InprocServer32 rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28220052-D9A9-44B1-AB98-EDC594D238B6}\InprocServer32\ = "C:\\Windows\\SysWow64\\yayxywVP.dll" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28220052-D9A9-44B1-AB98-EDC594D238B6}\InprocServer32\ThreadingModel = "Both" rundll32.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2284 rundll32.exe 2284 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe 1288 rundll32.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 2284 rundll32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2284 rundll32.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2284 rundll32.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4652 wrote to memory of 2284 4652 rundll32.exe 83 PID 4652 wrote to memory of 2284 4652 rundll32.exe 83 PID 4652 wrote to memory of 2284 4652 rundll32.exe 83 PID 2284 wrote to memory of 636 2284 rundll32.exe 5 PID 2284 wrote to memory of 1288 2284 rundll32.exe 98 PID 2284 wrote to memory of 1288 2284 rundll32.exe 98 PID 2284 wrote to memory of 1288 2284 rundll32.exe 98
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df23f0eaee937c1c5e5856e515255241_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\df23f0eaee937c1c5e5856e515255241_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2284 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\system32\yayxywVP.dll,a3⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1288
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\yayxywVP.dll
- Size 27KB
- SHA256 43583225526946e0e4102c2163bd3ef356844dc88d2ae25b6f70f937b708a709
- MD5 df23f0eaee937c1c5e5856e515255241
- SHA1 28d6f30c772528cb9055655fa24c499f854519db
- SHA512 2c46ce33111bc333fe93aa79e0f3fbf9ec3c444bbdab21a7a37c950451a95a9ce9d1c91a7e45f9da8ed6c582d91e2c322c25f697ab4b129846e84daa7a214e0c
- SSDEEP 384:H9VgrZ4l/3M+FeYF0wyXBabupgz+15oL6FtemZI/u2SPz/OGOo8j:H9VYu/35hvmCueqFtLS/cOXXj
- MD5 SHA1 SHA512 SSDEEP