Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/10/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll
-
Size
688KB
-
MD5
10928fe04d1c9d0baebb6cbf172bc901
-
SHA1
2536a4bbeb090a8435bb201d63484418702f3bea
-
SHA256
96ff5ac7de0d84f9c3d1d55008122d1e13c206388576f7d6c082b76963a7eabe
-
SHA512
bf0a3c1f9ddf7e2aa15360037cd25e9428f61d0f9a0aaa4682dd94dd3851e662c802fa9cf8b026576d3e83a88d3fc5c06dd6c1d72005579e38910ac9f7f0ab62
-
SSDEEP
12288:Y0ywjWtUO+Oke04VGUl6vhOiue+bhPrRx4vSZqB7Y0lnMyC2+EkRo6OaqTH9:HCwsdPJyC298ow29
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2364 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 536 rundll32.exe 536 rundll32.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe 2412 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 2 IoCs
pid pid_target Process procid_target 2024 536 WerFault.exe 30 2412 2364 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 2160 wrote to memory of 536 2160 rundll32.exe 30 PID 536 wrote to memory of 2364 536 rundll32.exe 31 PID 536 wrote to memory of 2364 536 rundll32.exe 31 PID 536 wrote to memory of 2364 536 rundll32.exe 31 PID 536 wrote to memory of 2364 536 rundll32.exe 31 PID 536 wrote to memory of 2024 536 rundll32.exe 34 PID 536 wrote to memory of 2024 536 rundll32.exe 34 PID 536 wrote to memory of 2024 536 rundll32.exe 34 PID 536 wrote to memory of 2024 536 rundll32.exe 34 PID 2364 wrote to memory of 2412 2364 rundll32mgr.exe 33 PID 2364 wrote to memory of 2412 2364 rundll32mgr.exe 33 PID 2364 wrote to memory of 2412 2364 rundll32mgr.exe 33 PID 2364 wrote to memory of 2412 2364 rundll32mgr.exe 33
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10928fe04d1c9d0baebb6cbf172bc901_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2364 -s 1564⤵
- Loads dropped DLL
- Program crash
PID:2412
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 2323⤵
- Program crash
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD50e0f0ae845d89c22bb6385f64a6b85fd
SHA10f3f1e7f18ab81572c5ce938d3880d4a5d7100ac
SHA2565a5b85c582d5d4b3b912ee6789babebf8ae6d87330d0d33d87274841952899dd
SHA512baec989a6329a2a60d954e83279fd57ba2000f8ed79e7a02d145bf44a5bffcd9a831c63f4b7d44e40c51e40b1dfbe72c5cebac04d0ce7b2295e3fd191b122350