Analysis
-
max time kernel
93s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
05/10/2024, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
16b114fc96af79e4350fadc999b268b0_JaffaCakes118.dll
Resource
win7-20240708-en
General
-
Target
16b114fc96af79e4350fadc999b268b0_JaffaCakes118.dll
-
Size
848KB
-
MD5
16b114fc96af79e4350fadc999b268b0
-
SHA1
ecc49411d73b84b14a344ba6619c208be28c8989
-
SHA256
3ac0de457e30c3bc0e0e75e2484e68b8aeeb7afb2aff2db0ca98e586e7cd9185
-
SHA512
f69910f903c69889a962ced9c872aecb07b3788357bb304fc66b2283b44e158c37fa16d0a5ddeabb0444590f9c10b58fa55d17e3154f28fb78c2938aaf8f1cf3
-
SSDEEP
12288:dehnaNPpSVZmNxRCwnwm3W3OHIIf5Wg4m0S5MK8ZXQyIIUjuUj2/75ok:deh0PpS6NxNnwYeOHX0zzSiKlyBjz5v
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1636 rundll32mgr.exe 3456 rundll32mgrmgr.exe -
Loads dropped DLL 2 IoCs
pid Process 3456 rundll32mgrmgr.exe 1636 rundll32mgr.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe File created C:\Windows\SysWOW64\rundll32mgrmgr.exe rundll32mgr.exe -
resource yara_rule behavioral2/memory/1636-17-0x0000000000400000-0x00000000004BC000-memory.dmp upx behavioral2/memory/3456-16-0x0000000000400000-0x0000000000481000-memory.dmp upx -
Program crash 3 IoCs
pid pid_target Process procid_target 4324 3456 WerFault.exe 85 4244 3596 WerFault.exe 82 3112 1636 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgrmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4152 wrote to memory of 3596 4152 rundll32.exe 82 PID 4152 wrote to memory of 3596 4152 rundll32.exe 82 PID 4152 wrote to memory of 3596 4152 rundll32.exe 82 PID 3596 wrote to memory of 1636 3596 rundll32.exe 83 PID 3596 wrote to memory of 1636 3596 rundll32.exe 83 PID 3596 wrote to memory of 1636 3596 rundll32.exe 83 PID 1636 wrote to memory of 3456 1636 rundll32mgr.exe 85 PID 1636 wrote to memory of 3456 1636 rundll32mgr.exe 85 PID 1636 wrote to memory of 3456 1636 rundll32mgr.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b114fc96af79e4350fadc999b268b0_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\16b114fc96af79e4350fadc999b268b0_JaffaCakes118.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\rundll32mgrmgr.exeC:\Windows\SysWOW64\rundll32mgrmgr.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3456 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3456 -s 101765⤵
- Program crash
PID:4324
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 101844⤵
- Program crash
PID:3112
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3596 -s 5803⤵
- Program crash
PID:4244
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3596 -ip 35961⤵PID:1984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3456 -ip 34561⤵PID:2984
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1636 -ip 16361⤵PID:1616
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
462KB
MD5737ad0e202cbc77fe21b05a97018fd17
SHA1d0c6ceff6779c02d6e9b7180a06369562fd96b1c
SHA25668e13ea527498c03274b46fd29bb2fa54f3c064c3a4d4299e8ab6f95c3afed34
SHA512dcd8dae554d55ac711024ec47aa3ba8a54cbd6b464e69ceb0f035f8b7930cddf8d42cfc7b0d34a621982134698f33a687091ed545ee8fca898db86468b55bae6
-
Filesize
230KB
MD5b42f5caf5d8471c34605faac7f278571
SHA18baf865dee9f3011fb467afe0f22cfd5bb5c5d47
SHA25638d89c5a881ec75d8f08139f374c8f7aa1aa22d0df211f31a82f9ef6fcb25d8c
SHA5122ce01499790db18f53043638cca357363cf993cefbd050e32a7c2f802f5bd0c58bef62da35050b6faef713cc030277bdc90a44922618808dd1573ca35f0fcb44