Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 11:58

General

  • Target

    efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll

  • Size

    1.9MB

  • MD5

    efbe63a9f85ddcfbe7e07aa84f8e78c5

  • SHA1

    b1bf45b604ccb555d778993f93bc414a7e050fc9

  • SHA256

    d2738b431897d289afa8accc0cfb5867995e443ecccac6fdc195b3c1dee7c8f9

  • SHA512

    061a1fb171120146cc3a9d1fec27087ce4d518899fffc2b6f73c298db9fa8efdb0078927ae2bb955709d720cbe66d0b3ba504f2d0c70fb5cc508d1e83807ccc0

  • SSDEEP

    24576:3zuRNyMlBacw/uPmT/ckk+5R6553giCAwqm9Sq9BG4jGKatZneRcd78IJhWeqPDE:3Gm/nTa3GjB//kZneRe8I7FcWq2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2096
      • C:\Users\Admin\AppData\Local\Temp\f77e908.exe
        "C:\Users\Admin\AppData\Local\Temp\f77e908.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2044
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2044 -s 532
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2056

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\f77e908.exe

    Filesize

    9KB

    MD5

    a014b8961283f1e07d7f31ecdd7db62f

    SHA1

    70714b6dc8abbaa5d1cba38c047ea3a4ec6ac065

    SHA256

    21ce0cdfaeb6d7f58bd17545be18f9cd3ac2476939112872d1a05d3164098f89

    SHA512

    bd0bb1405c7d74c941c5db0d3fd5fbe93544055f79db5076ab293c868568873df98f902c343096ff765be6c4911435617aab2ada15591dfc90606b5630d64869

  • memory/2044-41-0x0000000000E70000-0x0000000000E78000-memory.dmp

    Filesize

    32KB

  • memory/2096-11-0x0000000000860000-0x00000000008F3000-memory.dmp

    Filesize

    588KB

  • memory/2096-12-0x00000000028A0000-0x00000000039DB000-memory.dmp

    Filesize

    17.2MB

  • memory/2096-4-0x0000000000860000-0x00000000008F3000-memory.dmp

    Filesize

    588KB

  • memory/2096-7-0x0000000000860000-0x00000000008F3000-memory.dmp

    Filesize

    588KB

  • memory/2096-9-0x0000000002740000-0x00000000027EC000-memory.dmp

    Filesize

    688KB

  • memory/2096-8-0x0000000001FF0000-0x00000000021D9000-memory.dmp

    Filesize

    1.9MB

  • memory/2096-0-0x0000000001FF0000-0x00000000021D9000-memory.dmp

    Filesize

    1.9MB

  • memory/2096-3-0x00000000027F0000-0x0000000002895000-memory.dmp

    Filesize

    660KB

  • memory/2096-13-0x00000000039E0000-0x0000000003A6C000-memory.dmp

    Filesize

    560KB

  • memory/2096-14-0x0000000003A70000-0x0000000003AF7000-memory.dmp

    Filesize

    540KB

  • memory/2096-15-0x0000000003A70000-0x0000000003AF7000-memory.dmp

    Filesize

    540KB

  • memory/2096-17-0x0000000003A70000-0x0000000003AF7000-memory.dmp

    Filesize

    540KB

  • memory/2096-18-0x00000000000B0000-0x00000000000B3000-memory.dmp

    Filesize

    12KB

  • memory/2096-20-0x00000000000C0000-0x00000000000C5000-memory.dmp

    Filesize

    20KB

  • memory/2096-1-0x0000000002660000-0x000000000273E000-memory.dmp

    Filesize

    888KB

  • memory/2096-2-0x0000000002740000-0x00000000027EC000-memory.dmp

    Filesize

    688KB