Analysis

  • max time kernel
    93s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/09/2024, 11:58

General

  • Target

    efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll

  • Size

    1.9MB

  • MD5

    efbe63a9f85ddcfbe7e07aa84f8e78c5

  • SHA1

    b1bf45b604ccb555d778993f93bc414a7e050fc9

  • SHA256

    d2738b431897d289afa8accc0cfb5867995e443ecccac6fdc195b3c1dee7c8f9

  • SHA512

    061a1fb171120146cc3a9d1fec27087ce4d518899fffc2b6f73c298db9fa8efdb0078927ae2bb955709d720cbe66d0b3ba504f2d0c70fb5cc508d1e83807ccc0

  • SSDEEP

    24576:3zuRNyMlBacw/uPmT/ckk+5R6553giCAwqm9Sq9BG4jGKatZneRcd78IJhWeqPDE:3Gm/nTa3GjB//kZneRe8I7FcWq2

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\efbe63a9f85ddcfbe7e07aa84f8e78c5_JaffaCakes118.dll,#1
      2⤵
      • Blocklisted process makes network request
      • Checks computer location settings
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\e587cad.exe
        "C:\Users\Admin\AppData\Local\Temp\e587cad.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2436
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2436 -s 804
          4⤵
          • Program crash
          PID:3840
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 2436 -ip 2436
    1⤵
      PID:1788

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\e587cad.exe

      Filesize

      9KB

      MD5

      a014b8961283f1e07d7f31ecdd7db62f

      SHA1

      70714b6dc8abbaa5d1cba38c047ea3a4ec6ac065

      SHA256

      21ce0cdfaeb6d7f58bd17545be18f9cd3ac2476939112872d1a05d3164098f89

      SHA512

      bd0bb1405c7d74c941c5db0d3fd5fbe93544055f79db5076ab293c868568873df98f902c343096ff765be6c4911435617aab2ada15591dfc90606b5630d64869

    • memory/2144-10-0x0000000003380000-0x0000000003413000-memory.dmp

      Filesize

      588KB

    • memory/2144-13-0x00000000045F0000-0x0000000004677000-memory.dmp

      Filesize

      540KB

    • memory/2144-3-0x0000000003380000-0x0000000003413000-memory.dmp

      Filesize

      588KB

    • memory/2144-6-0x0000000003380000-0x0000000003413000-memory.dmp

      Filesize

      588KB

    • memory/2144-7-0x0000000003090000-0x000000000316E000-memory.dmp

      Filesize

      888KB

    • memory/2144-9-0x0000000003220000-0x00000000032CC000-memory.dmp

      Filesize

      688KB

    • memory/2144-8-0x0000000000400000-0x00000000005E9000-memory.dmp

      Filesize

      1.9MB

    • memory/2144-0-0x0000000003090000-0x000000000316E000-memory.dmp

      Filesize

      888KB

    • memory/2144-2-0x00000000032D0000-0x0000000003375000-memory.dmp

      Filesize

      660KB

    • memory/2144-12-0x0000000004560000-0x00000000045EC000-memory.dmp

      Filesize

      560KB

    • memory/2144-11-0x0000000003420000-0x000000000455B000-memory.dmp

      Filesize

      17.2MB

    • memory/2144-14-0x00000000045F0000-0x0000000004677000-memory.dmp

      Filesize

      540KB

    • memory/2144-16-0x00000000045F0000-0x0000000004677000-memory.dmp

      Filesize

      540KB

    • memory/2144-17-0x0000000000C70000-0x0000000000C73000-memory.dmp

      Filesize

      12KB

    • memory/2144-19-0x0000000000C80000-0x0000000000C85000-memory.dmp

      Filesize

      20KB

    • memory/2144-1-0x0000000003220000-0x00000000032CC000-memory.dmp

      Filesize

      688KB

    • memory/2436-35-0x0000000072DFE000-0x0000000072DFF000-memory.dmp

      Filesize

      4KB

    • memory/2436-36-0x00000000002A0000-0x00000000002A8000-memory.dmp

      Filesize

      32KB