815e55850982ba8ef596047737c5ee717dfbe1bc68887a46fc78ed7962201dde

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-11-2024 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll
Size

252KB
MD5

97572437b6a78aaaa9d7925a3e3c48a3
SHA1

20ec3cfc185ce474f4d86bf87a6dded70183ef61
SHA256

815e55850982ba8ef596047737c5ee717dfbe1bc68887a46fc78ed7962201dde
SHA512

cd757eec776d091a4a8265d6a9be0cceb07bd618405f81b32435ba54765fdf98081cb1316526a97cfa7bc2369cc445415854eefb74994bc5a9d93fc4577b1d78
SSDEEP

6144:dTa12CoCckAe8a0jbUjmJmdG/i8OJQvdjl2psxtd89:ik3djbo4mAK8eQvJ4psx89

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

rundll32mgr.exe

pid process

2732 rundll32mgr.exe

pid	process
2732	rundll32mgr.exe

Loads dropped DLL 11 IoCs

Processes:

rundll32.exeWerFault.exe

pid	process
2036	rundll32.exe
2036	rundll32.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe
2892	WerFault.exe

Drops file in System32 directory 1 IoCs

Processes:

rundll32.exe

description ioc process

File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

2892 2732 WerFault.exe rundll32mgr.exe
2816 2036 WerFault.exe rundll32.exe

description	ioc	process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

pid	pid_target	process	target process
2892	2732	WerFault.exe	rundll32mgr.exe
2816	2036	WerFault.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

rundll32.exerundll32mgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

rundll32.exerundll32.exerundll32mgr.exe

description	pid	process	target process
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2748 wrote to memory of 2036	2748	rundll32.exe	rundll32.exe
PID 2036 wrote to memory of 2732	2036	rundll32.exe	rundll32mgr.exe
PID 2036 wrote to memory of 2732	2036	rundll32.exe	rundll32mgr.exe
PID 2036 wrote to memory of 2732	2036	rundll32.exe	rundll32mgr.exe
PID 2036 wrote to memory of 2732	2036	rundll32.exe	rundll32mgr.exe
PID 2732 wrote to memory of 2892	2732	rundll32mgr.exe	WerFault.exe
PID 2732 wrote to memory of 2892	2732	rundll32mgr.exe	WerFault.exe
PID 2732 wrote to memory of 2892	2732	rundll32mgr.exe	WerFault.exe
PID 2732 wrote to memory of 2892	2732	rundll32mgr.exe	WerFault.exe
PID 2036 wrote to memory of 2816	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2816	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2816	2036	rundll32.exe	WerFault.exe
PID 2036 wrote to memory of 2816	2036	rundll32.exe	WerFault.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\97572437b6a78aaaa9d7925a3e3c48a3_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2732 -s 156
      4⤵
      Loads dropped DLL
      Program crash
      PID:2892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2036 -s 224
    3⤵
    - Program crash
    PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rundll32mgr.exe

Filesize
187KB

MD5
27fdabf7c440551ce0d41832bb40e0e4

SHA1
c3a6f07789562c1edbea44197a3f6cb3f6d345c9

SHA256
52f26137f9a813c374e5bca7ae97f2f31c1f8084276944fdc5e97df7a69a86c4

SHA512
4c13cfe5ed6741933d83ba0af39bd9cc544033328fe015b5ec1f1eff358e54764814f60085c0b4528034e2e8ab2f94694e186b27d9e66e42e01391ba20f38df5

Download Submit
memory/2036-1-0x000000006D100000-0x000000006D13F000-memory.dmp

Filesize
252KB

Download
memory/2036-8-0x00000000006B0000-0x00000000006EF000-memory.dmp

Filesize
252KB

Download
memory/2036-21-0x000000006D100000-0x000000006D13F000-memory.dmp

Filesize
252KB

Download
memory/2732-10-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2732-20-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download