Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22-01-2025 23:29
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_11eaa74847cb8fcc6d1014e5b58b5875.dll
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_11eaa74847cb8fcc6d1014e5b58b5875.dll
-
Size
284KB
-
MD5
11eaa74847cb8fcc6d1014e5b58b5875
-
SHA1
971f0481c44ca46df2b2c57859c50e6328e89e48
-
SHA256
57c40e33a8ce9583d80085fff69f9ebc5acf4934ba991b0fcf8cd2bc8a91c4b0
-
SHA512
e04ccc1f725f143e9d7af8984a4caec1c6628e0f638adc2150a4432b88b250649eeda51139c3a75fc302296f891220fa929cf3b7ad5f3a1e8cd3579ff97f5194
-
SSDEEP
6144:LMJOWK4l0wqOVq1o1QiujTlPDyqNwTSb29QqBrC9pI:L2OWK4lljujTlPOqNw229QqBrC92
Malware Config
Signatures
-
Ramnit family
-
Executes dropped EXE 1 IoCs
pid Process 1800 rundll32mgr.exe -
Loads dropped DLL 1 IoCs
pid Process 1800 rundll32mgr.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\rundll32mgr.exe rundll32.exe -
resource yara_rule behavioral2/memory/1800-7-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-9-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-8-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-6-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-15-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-14-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-13-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-12-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral2/memory/1800-23-0x0000000000400000-0x0000000000461000-memory.dmp upx -
Program crash 1 IoCs
pid pid_target Process procid_target 2420 1800 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32mgr.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1800 rundll32mgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3052 wrote to memory of 4888 3052 rundll32.exe 83 PID 3052 wrote to memory of 4888 3052 rundll32.exe 83 PID 3052 wrote to memory of 4888 3052 rundll32.exe 83 PID 4888 wrote to memory of 1800 4888 rundll32.exe 84 PID 4888 wrote to memory of 1800 4888 rundll32.exe 84 PID 4888 wrote to memory of 1800 4888 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11eaa74847cb8fcc6d1014e5b58b5875.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_11eaa74847cb8fcc6d1014e5b58b5875.dll,#12⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Windows\SysWOW64\rundll32mgr.exeC:\Windows\SysWOW64\rundll32mgr.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:1800 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 2604⤵
- Program crash
PID:2420
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1800 -ip 18001⤵PID:1004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD54f3387277ccbd6d1f21ac5c07fe4ca68
SHA1e16506f662dc92023bf82def1d621497c8ab5890
SHA256767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA5129da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219
-
Filesize
133KB
MD5cdb08259f376e72d84caaff2246e7b8d
SHA1c812ffaebdac00ea61901b2a3d0b40bd9495d1da
SHA256c572bcb3d9c247d7f45fefaaa5d62463bf5ef701a13cbbfc160dc81fc0301a05
SHA5121e693e099ce8cad51863e44e522cb9b67ec785891b36eb623048a8ab6d37619a2a599c8237c5757f85aa696335c57c54b55afd2a92189cc46378998dad8af7f7