96b0133138f1d9f6a22a8eb3cd70abc0ca6c9ae447db63b364f8affc518d9184

Analysis

max time kernel
92s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 12:27

Target

fa67f0f08e824e770c61da32167a71af_JaffaCakes118.dll
Size

49KB
MD5

fa67f0f08e824e770c61da32167a71af
SHA1

6b0c0864cff5d2276193987e84433df1429520e5
SHA256

96b0133138f1d9f6a22a8eb3cd70abc0ca6c9ae447db63b364f8affc518d9184
SHA512

83f0e090b6ae59507bab70b9fb977054c34d9f7512db56f67d206ded676fad04a09eeb84aa22c5b88c347d3e16eb9da20449e291dc9355f6a030266e1a51ebe5
SSDEEP

1536:rUqhmQrd4WYUrOd5/wsMyYLov+EQkrblEMENcE:ZmXW/Ww1yYLovyknlEMcV

Score

6^/10

Modifies WinLogon 2 TTPs 8 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Shutdown = "WinOff2EX"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Asynchronous = "1"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Impersonate = "0"	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\DllName = "mdhcp32.dll"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Startup = "WinStart2EX"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mdhcp32\Logoff = "WinOff2EX"	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4616 wrote to memory of 2672	4616	rundll32.exe	84
PID 4616 wrote to memory of 2672	4616	rundll32.exe	84
PID 4616 wrote to memory of 2672	4616	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa67f0f08e824e770c61da32167a71af_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4616
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fa67f0f08e824e770c61da32167a71af_JaffaCakes118.dll,#1
  2⤵
  - Modifies WinLogon
  - System Location Discovery: System Language Discovery
  PID:2672