Analysis

  • max time kernel
    94s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 17:00

General

  • Target

    0fbf6aebb7abe0cf6397511870b68341_JaffaCakes118.dll

  • Size

    264KB

  • MD5

    0fbf6aebb7abe0cf6397511870b68341

  • SHA1

    4ade45cb13aaff6812047d68bb6c4c9caa20694b

  • SHA256

    b2f2278e08e7948fdadb10567269e42b9afe2922e650d5e5bee2990432386370

  • SHA512

    a4a519b441bafd41c354cdd80d41ddacc9150325988628994943c0dde939c40c5410e4b3a4ffb3cac96e23da7e0771a668b7a17c62d28ba9a0065231c487fd6b

  • SSDEEP

    3072:n4vRJRkTcZ7fcxdl5CTdBoEBClwrnfJMtZbzOPrLToxdv0/pMBLCAivV+8KjvYfC:nXHngrXV6L/0cPjMN/m+POz

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fbf6aebb7abe0cf6397511870b68341_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:180
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0fbf6aebb7abe0cf6397511870b68341_JaffaCakes118.dll,#1
      2⤵
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\SysWOW64\rundll32mgr.exe
        C:\Windows\SysWOW64\rundll32mgr.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4164
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4164 -s 264
          4⤵
          • Program crash
          PID:4168
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4164 -ip 4164
    1⤵
      PID:1584

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\SysWOW64\rundll32mgr.exe

            Filesize

            105KB

            MD5

            1713dcea0892955ae4ad238bf4b9a34d

            SHA1

            172c10720153e717402654f97ad56516f43705bf

            SHA256

            e4cbc03a8bea10728e756b7187435b3675af2d45ace12e6b6641e44b25d54b23

            SHA512

            e0a0a1ec9e9380bcc1692016dcadb6b794ef13e3a49b9709799c8b281401cd0faa0b63b0aa0fa750820cdec674f7c6e02e259e66cf843975fcbd49e9c1be021c

          • memory/3392-0-0x0000000074FE0000-0x0000000075024000-memory.dmp

            Filesize

            272KB

          • memory/4164-4-0x0000000000400000-0x000000000045B000-memory.dmp

            Filesize

            364KB

          • memory/4164-6-0x00000000005C0000-0x00000000005C1000-memory.dmp

            Filesize

            4KB

          • memory/4164-7-0x0000000000400000-0x000000000045B000-memory.dmp

            Filesize

            364KB