Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 05:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ef276025b9e93268c4458c3aba90c46f_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef276025b9e93268c4458c3aba90c46f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ef276025b9e93268c4458c3aba90c46f_JaffaCakes118.dll
-
Size
34KB
-
MD5
ef276025b9e93268c4458c3aba90c46f
-
SHA1
cf97fbe106afe010c7428a15b3e7eadfea295bc7
-
SHA256
f892c2e646f03a662e1057cb47793870318d8312532459fe398fc3573f7df459
-
SHA512
0950892f4202076dd3ab683ea1399988f1070ab15689bb2ed03f4236e64f6258c994de683e742593e674fc7a4673cee05cc428a471ded01f424819ec97a80ee0
-
SSDEEP
768:gnjXG2X4oU1xyKhHOTC6ghXK/a6bk4AmAarizX0KIpJKZa:grhQx1uT7gs/GmA8tpkZa
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2300 rundll32.exe -
Modifies WinLogon 2 TTPs 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Logon = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Impersonate = "0" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Startup = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Asynchronous = "1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\DllName = "C:\\Windows\\system32\\__c002D2FA.dat" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Startup = "B" rundll32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Asynchronous = "1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\DllName = "C:\\Windows\\system32\\__c002D2FA.dat" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c002D2FA\Logon = "B" rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\__c002D2FA.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\__c002D2FA.dat rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3004 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe 2300 rundll32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3000 wrote to memory of 3004 3000 rundll32.exe 30 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31 PID 3004 wrote to memory of 2300 3004 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef276025b9e93268c4458c3aba90c46f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ef276025b9e93268c4458c3aba90c46f_JaffaCakes118.dll,#12⤵
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Windows\system32\__c002D2FA.dat",B3⤵
- Loads dropped DLL
- Modifies WinLogon
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2300
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5ef276025b9e93268c4458c3aba90c46f
SHA1cf97fbe106afe010c7428a15b3e7eadfea295bc7
SHA256f892c2e646f03a662e1057cb47793870318d8312532459fe398fc3573f7df459
SHA5120950892f4202076dd3ab683ea1399988f1070ab15689bb2ed03f4236e64f6258c994de683e742593e674fc7a4673cee05cc428a471ded01f424819ec97a80ee0