Analysis

  • max time kernel
    141s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2024 14:42

General

  • Target

    f00438c060616c2255f95dcbfd983d0b_JaffaCakes118.exe

  • Size

    112KB

  • MD5

    f00438c060616c2255f95dcbfd983d0b

  • SHA1

    8a8ff162ed055872593fa9ad311e3fde8461374a

  • SHA256

    af92923de76a01e2a2c56696bb1462fd4619bca12d8749725f8ae35315e144fd

  • SHA512

    a4b2f42beb7bf540a873ef0548d772e5450db06b2ec72330421c12a43b33bd11ed3b47fe868cee7bd07383a78ff01fe72a0806e2e47db39a0c08df696b162ab3

  • SSDEEP

    1536:TqRuhXx2plzGRondkyeGpZcUk+BSxLdl4dmikuDVCGYnHInbSTuVappCt:TxXa0kdnRpZcqAtdlqgAYnH22//

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f00438c060616c2255f95dcbfd983d0b_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\f00438c060616c2255f95dcbfd983d0b_JaffaCakes118.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:712
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe "C:\Users\Admin\AppData\Local\detend.dll",Startup
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4824
      • C:\Windows\SysWOW64\rundll32.exe
        rundll32.exe "C:\Users\Admin\AppData\Local\detend.dll",iep
        3⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\detend.dll

    Filesize

    112KB

    MD5

    c34e65950d1b5900bddf7859940327a9

    SHA1

    5165f8391dbbd26226257c67da0536b4ab33f0d9

    SHA256

    b19355a5a942e403a7027543db65731f3dc3b1261a652b47e6314a53a8668340

    SHA512

    3f7d53749fa36be842a391602e4cae766889e8917fa584e0367b7af70423e1b6230240c8e33ca1ed64e761730881d8c492fd20481fb5ea6c2d6a3e9a66940160

  • memory/712-14-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/712-0-0x00000000023D0000-0x00000000023E0000-memory.dmp

    Filesize

    64KB

  • memory/712-1-0x00000000023D0000-0x00000000023E0000-memory.dmp

    Filesize

    64KB

  • memory/712-10-0x00000000023D0000-0x00000000023E0000-memory.dmp

    Filesize

    64KB

  • memory/712-11-0x00000000023D0000-0x00000000023E0000-memory.dmp

    Filesize

    64KB

  • memory/712-2-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/2224-27-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/2224-25-0x0000000002B00000-0x0000000002B10000-memory.dmp

    Filesize

    64KB

  • memory/2224-23-0x0000000002B00000-0x0000000002B10000-memory.dmp

    Filesize

    64KB

  • memory/2224-22-0x0000000002B00000-0x0000000002B10000-memory.dmp

    Filesize

    64KB

  • memory/4824-13-0x0000000002C50000-0x0000000002C60000-memory.dmp

    Filesize

    64KB

  • memory/4824-15-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/4824-12-0x0000000002C50000-0x0000000002C60000-memory.dmp

    Filesize

    64KB

  • memory/4824-7-0x0000000002C50000-0x0000000002C60000-memory.dmp

    Filesize

    64KB

  • memory/4824-21-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/4824-8-0x0000000002C50000-0x0000000002C60000-memory.dmp

    Filesize

    64KB

  • memory/4824-26-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/4824-9-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/4824-28-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB

  • memory/4824-30-0x0000000010000000-0x000000001001C000-memory.dmp

    Filesize

    112KB