Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-10-2024 05:24

General

  • Target

    0e1f4a136d096fb3ec7f09a73944d360_JaffaCakes118.dll

  • Size

    156KB

  • MD5

    0e1f4a136d096fb3ec7f09a73944d360

  • SHA1

    7b589dc9ee56231e4a34aa3926260704c07ce753

  • SHA256

    1c35430db0926e2176e8e884293d786d232d562e0611899f6ec70e54936cfd16

  • SHA512

    0a3fd7a84dafe913613b006f88e5e1a282aaaca3d2f6f60909f205e3563a9a196d15f6a9d6c7f4c08d87e30d59d0274872b48a1183eb9f53ac7a1e4f355499c6

  • SSDEEP

    3072:CWrQ+rL8+jnTF8dnPSyZHoOWUOLNAD7v3G8h/CqIRqi:JBrL82udnBH1WU447fHhjc

Malware Config

Signatures

  • Blocklisted process makes network request 4 IoCs
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs .reg file with regedit 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1f4a136d096fb3ec7f09a73944d360_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4396
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0e1f4a136d096fb3ec7f09a73944d360_JaffaCakes118.dll,#1
      2⤵
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Windows\SysWOW64\rundll32.exe
        C:\Windows\system32\rundll32.exe C:\PROGRA~3\alw9r06j.plz,GL300
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4000
        • C:\Windows\SysWOW64\regedit.exe
          C:\Windows\regedit.exe -s C:\PROGRA~3\j60r9wla.reg
          4⤵
          • Server Software Component: Terminal Services DLL
          • System Location Discovery: System Language Discovery
          • Runs .reg file with regedit
          PID:4508

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\PROGRA~3\alw9r06j.plz

    Filesize

    156KB

    MD5

    0e1f4a136d096fb3ec7f09a73944d360

    SHA1

    7b589dc9ee56231e4a34aa3926260704c07ce753

    SHA256

    1c35430db0926e2176e8e884293d786d232d562e0611899f6ec70e54936cfd16

    SHA512

    0a3fd7a84dafe913613b006f88e5e1a282aaaca3d2f6f60909f205e3563a9a196d15f6a9d6c7f4c08d87e30d59d0274872b48a1183eb9f53ac7a1e4f355499c6

  • C:\ProgramData\j60r9wla.reg

    Filesize

    285B

    MD5

    0bc7599dd41f6e2c71d50b7dc4b910b3

    SHA1

    c07878433725c57d7d6198f552d39aa4e51a7ec1

    SHA256

    7fd977382133f1c9ee1735c773686b4a9c0def7012f616a08587011b259b883d

    SHA512

    32d6fa43d19885ef0fd20868036b34f1e0e6c3ea4026caa53f8e5c6ae26081a5ac172b07ca018e7182ff00808fd8f43d7b7120b58dca9d231128b6f4b824a4c6

  • memory/4000-19-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-25-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-7-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/4000-8-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-10-0x0000000074CF1000-0x0000000074D0F000-memory.dmp

    Filesize

    120KB

  • memory/4000-17-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-71-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-63-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-33-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-59-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4000-57-0x0000000074CF0000-0x0000000074D1B000-memory.dmp

    Filesize

    172KB

  • memory/4100-2-0x0000000074D30000-0x0000000074D5B000-memory.dmp

    Filesize

    172KB

  • memory/4100-3-0x0000000074D31000-0x0000000074D4F000-memory.dmp

    Filesize

    120KB

  • memory/4100-0-0x0000000000B70000-0x0000000000B71000-memory.dmp

    Filesize

    4KB