16d626e7c865d793eb4d96695201e853e25a7e9aa6ec18bec21c91e61b7877da

Analysis

max time kernel
94s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-01-2025 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_2924e5b67b8a03b5ee9beddfe7f30b3e.dll
Size

2.5MB
MD5

2924e5b67b8a03b5ee9beddfe7f30b3e
SHA1

9830b88322fc8f0c60cc8ed5d5b7d131ee3318b6
SHA256

16d626e7c865d793eb4d96695201e853e25a7e9aa6ec18bec21c91e61b7877da
SHA512

3d658c461be14b364f28d5a1cc2643b889becb9eabaf9cc676c31d951aa58076608379a9fc37b78fbe3ff286caeb85d86906df6daf48b86fda1ec7258eaef64f
SSDEEP

49152:P3pp9ziy5bRCrEaoWzw7ai91wgvTBBsCkh9Sp3BVcmUG8lFN6ijGUKYsVMLz6ons:P3pv+y5dIVs7aWPvTBBKh9UBVc/ln16T

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1712	rundll32mgr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023c56-3.dat	upx
behavioral2/memory/1712-5-0x0000000000400000-0x0000000000478000-memory.dmp	upx
behavioral2/memory/1712-8-0x0000000000400000-0x0000000000478000-memory.dmp	upx

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3768	1712	WerFault.exe
940	2780	WerFault.exe	84

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2780	5076	rundll32.exe	84
PID 5076 wrote to memory of 2780	5076	rundll32.exe	84
PID 5076 wrote to memory of 2780	5076	rundll32.exe	84
PID 2780 wrote to memory of 1712	2780	rundll32.exe	85
PID 2780 wrote to memory of 1712	2780	rundll32.exe	85
PID 2780 wrote to memory of 1712	2780	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2924e5b67b8a03b5ee9beddfe7f30b3e.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_2924e5b67b8a03b5ee9beddfe7f30b3e.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1712
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 264
      4⤵
      Program crash
      PID:3768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 636
    3⤵
    - Program crash
    PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1712 -ip 1712
1⤵
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2780 -ip 2780
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
221KB

MD5
e70ecf2fa14973e7c61384fd7dc5c4e9

SHA1
b284f9366cee9e961d9ee3be9148a87a5d2ed7f1

SHA256
fd0f984f320a0422206c370fbc00c2e931bb9236d2ae36c4f9a968fc9241571a

SHA512
563f7501121a16cd24a67443a919afdf4d011e930fea2719418919b9b1b1e30620d63d83954f8427899628a7023521a69cbae20597258f7654647c987c0a9aef

Download Submit
memory/1712-6-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1712-5-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/1712-8-0x0000000000400000-0x0000000000478000-memory.dmp

Filesize
480KB

Download
memory/2780-0-0x0000000074900000-0x0000000074B97000-memory.dmp

Filesize
2.6MB

Download
memory/2780-9-0x0000000074900000-0x0000000074B97000-memory.dmp

Filesize
2.6MB

Download