Analysis

  • max time kernel
    121s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2024, 21:30

General

  • Target

    10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll

  • Size

    688KB

  • MD5

    10928fe04d1c9d0baebb6cbf172bc901

  • SHA1

    2536a4bbeb090a8435bb201d63484418702f3bea

  • SHA256

    96ff5ac7de0d84f9c3d1d55008122d1e13c206388576f7d6c082b76963a7eabe

  • SHA512

    bf0a3c1f9ddf7e2aa15360037cd25e9428f61d0f9a0aaa4682dd94dd3851e662c802fa9cf8b026576d3e83a88d3fc5c06dd6c1d72005579e38910ac9f7f0ab62

  • SSDEEP

    12288:Y0ywjWtUO+Oke04VGUl6vhOiue+bhPrRx4vSZqB7Y0lnMyC2+EkRo6OaqTH9:HCwsdPJyC298ow29

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 9 IoCs
  • Drops file in System32 directory 1 IoCs
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll,#1
      2⤵
      • Loads dropped DLL
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2364
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 156
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:2412
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 232
        3⤵
        • Program crash
        PID:2024

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Windows\SysWOW64\rundll32mgr.exe

          Filesize

          59KB

          MD5

          0e0f0ae845d89c22bb6385f64a6b85fd

          SHA1

          0f3f1e7f18ab81572c5ce938d3880d4a5d7100ac

          SHA256

          5a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd

          SHA512

          baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350

        • memory/536-5-0x0000000010000000-0x00000000100AD000-memory.dmp

          Filesize

          692KB

        • memory/536-1-0x0000000010000000-0x00000000100AD000-memory.dmp

          Filesize

          692KB

        • memory/536-0-0x0000000010000000-0x00000000100AD000-memory.dmp

          Filesize

          692KB

        • memory/536-18-0x0000000010000000-0x00000000100AD000-memory.dmp

          Filesize

          692KB