Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-12-2024 02:14
Static task
static1
Behavioral task
behavioral1
Sample
fe096f306f22da4145424fa903585b9f_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
fe096f306f22da4145424fa903585b9f_JaffaCakes118.dll
-
Size
1.3MB
-
MD5
fe096f306f22da4145424fa903585b9f
-
SHA1
dc3193c3fdb332121e6c11407381db34e946ccfe
-
SHA256
c66b2aaa9fff0906e2cdcfbeda4c0b1f848c117e6c4579c0918bb4a6cf18080e
-
SHA512
31a70e0be53328314e5e3c9d2f6677205a9f47939910cd89a6a95f81abedcd257d318a8b4fb57433153a2877a84075fdd4546bc1a790567588f1deaf7c8c0635
-
SSDEEP
24576:mFOoCvSZSNnCantpaOahlOr9QzHDM9ukxvIDyyG5Rdo/1Xt6pBRuGX+ftAAb:zmaujlS6HQRZIWyG574Nkp21
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1328 rundll32mgr.exe -
Loads dropped DLL 9 IoCs
pid Process 2172 rundll32.exe 2172 rundll32.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe 2480 WerFault.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2480 1328 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2516 wrote to memory of 2172 2516 rundll32.exe 30 PID 2172 wrote to memory of 1328 2172 rundll32.exe 31 PID 2172 wrote to memory of 1328 2172 rundll32.exe 31 PID 2172 wrote to memory of 1328 2172 rundll32.exe 31 PID 2172 wrote to memory of 1328 2172 rundll32.exe 31 PID 1328 wrote to memory of 2480 1328 rundll32mgr.exe 32 PID 1328 wrote to memory of 2480 1328 rundll32mgr.exe 32 PID 1328 wrote to memory of 2480 1328 rundll32mgr.exe 32 PID 1328 wrote to memory of 2480 1328 rundll32mgr.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe096f306f22da4145424fa903585b9f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fe096f306f22da4145424fa903585b9f_JaffaCakes118.dll,#12⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 1004⤵
- Loads dropped DLL
- Program crash
PID:2480
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60KB
MD594f2f6ffbba8e7644668b51b39983916
SHA163357bbdf90101969117983dbc0d4ed0e713c4d7
SHA256ede7603855cb37082c241c720a6650988c684eb3bcb263e5dd7b457458940fed
SHA512d04430ceac70c6fa71d07d9ee82ac2bb5e6c0641d5c9e7e5a3ed39d342e8b198f367676516a55f0653e0b88635a027b9ad220e223145b8be8df281bb6faf7156