Analysis
-
max time kernel
126s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2024, 22:02
Static task
static1
Behavioral task
behavioral1
Sample
10ab72dc41b1e25d3481fa976e32646a_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
10ab72dc41b1e25d3481fa976e32646a_JaffaCakes118.dll
-
Size
272KB
-
MD5
10ab72dc41b1e25d3481fa976e32646a
-
SHA1
035ea4614924beb54203b33a140bf5056249e6b2
-
SHA256
c5a68e2b4c7e9960deae348969f078947dd8f70b2446869446f191c13c9cdf1b
-
SHA512
fb7bd7d5435ae5e2486ba06ae2969127e91dc3e16e281cb810e175600a45d577bfd83d521ba028538ea4028ca222b0fb5e2ea8d6128871563b4ab6e37f9f97ed
-
SSDEEP
6144:QKZp3KNjVGvY6Vr9blG+7T6vVifVSRGFyt9JFrWfg:QCxKNjcf91Jut9JFrW4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1228 rundll32mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 1228 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/1228-6-0x0000000000400000-0x0000000000466000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 588 1228 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3444 wrote to memory of 1472 3444 rundll32.exe 89 PID 3444 wrote to memory of 1472 3444 rundll32.exe 89 PID 3444 wrote to memory of 1472 3444 rundll32.exe 89 PID 1472 wrote to memory of 1228 1472 rundll32.exe 90 PID 1472 wrote to memory of 1228 1472 rundll32.exe 90 PID 1472 wrote to memory of 1228 1472 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10ab72dc41b1e25d3481fa976e32646a_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\10ab72dc41b1e25d3481fa976e32646a_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1228 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1228 -s 101764⤵
- Program crash
PID:588
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1228 -ip 12281⤵PID:2456
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3056,i,1828333185976713750,7918646547767660928,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:81⤵PID:4128
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
156KB
MD5c8ba737481aa4e52d48b058dfbb961bb
SHA1123f696d27604eed21a1b5d1811a95fc96650db5
SHA2569490d1dbfd40542e0300bac29234fcb46847e0899dfb8b827c849b79c3662c25
SHA51208cb23a1bd63c8600373e8e1377366faae7f78247bd03fcb4bb110291b5e0e6388df8e115d48be23f5ecc813b23a06a6537c5deb3be106504ae9d52d882049f2