Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/10/2024, 21:41
Static task
static1
Behavioral task
behavioral1
Sample
4a2360253b77f6b192e213cadeb5a94f_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
4a2360253b77f6b192e213cadeb5a94f_JaffaCakes118.dll
Resource
win10v2004-20241007-en
General
-
Target
4a2360253b77f6b192e213cadeb5a94f_JaffaCakes118.dll
-
Size
407KB
-
MD5
4a2360253b77f6b192e213cadeb5a94f
-
SHA1
55f3ee4b670f1f2f9740df5bbcc86c8101d4711f
-
SHA256
fcd9ddd98ad8a2900a8dc48ef8d66c58236ddcfc02f815c9d9b3c2ea6bf3e1c6
-
SHA512
55c725c12102efd8f0d5a08a0911ecfc087954d141a10206bd209af5ca1406d8c2aa09ca1b90333c8a5f6be29b42b43d98996e9a5a9fdecb1f95b54e5e97635a
-
SSDEEP
12288:de4tOuoCJfrdGD1S+HXks+sxdfGyatMGvR:de7CJDdGZS+HksxQjt9R
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\-58-5955125 rundll32.exe File created C:\Windows\SysWOW64\04d rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31 PID 2512 wrote to memory of 3060 2512 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a2360253b77f6b192e213cadeb5a94f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4a2360253b77f6b192e213cadeb5a94f_JaffaCakes118.dll,#12⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3060
-