Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-05-2024 00:45
Static task
static1
Behavioral task
behavioral1
Sample
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
Resource
win7-20240221-en
General
-
Target
7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll
-
Size
1.2MB
-
MD5
7ef8cd0a29c3dfa39a5a98cf7c086ae9
-
SHA1
b6f558f6460c3fdd0029860e38a08eee31941c01
-
SHA256
1322ae78c8352abc316a3ec642f8acf7a0187d2796bfd67c53fd64722bdcba6d
-
SHA512
d8a8d6fc34003d726ccd16bc1dabde97d63bcb32d5714478b08c98d6237fa06cffeb79ce9c51c1e11e6a00e96fa0a6df90ced26f6e51a3ff70626d0f67704483
-
SSDEEP
24576:S8r6tuuWnigUAOJtWmEBMoBBX3muHJ1JD:+FlznPWmEaonX3pH
Malware Config
Extracted
danabot
149.154.159.213
221.11.15.186
140.200.163.110
238.214.73.11
77.163.235.35
151.236.14.84
204.201.196.112
43.150.102.9
115.91.243.217
198.6.155.175
Signatures
-
Blocklisted process makes network request 9 IoCs
Processes:
rundll32.exeflow pid process 2 2092 rundll32.exe 3 2092 rundll32.exe 6 2092 rundll32.exe 9 2092 rundll32.exe 12 2092 rundll32.exe 13 2092 rundll32.exe 14 2092 rundll32.exe 17 2092 rundll32.exe 18 2092 rundll32.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2520 2196 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 1912 wrote to memory of 2196 1912 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2092 2196 rundll32.exe rundll32.exe PID 2196 wrote to memory of 2520 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2520 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2520 2196 rundll32.exe WerFault.exe PID 2196 wrote to memory of 2520 2196 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\SysWOW64\rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ef8cd0a29c3dfa39a5a98cf7c086ae9_JaffaCakes118.dll,f03⤵
- Blocklisted process makes network request
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 3643⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2092-28-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/2092-41-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-39-0x0000000000570000-0x0000000000576000-memory.dmpFilesize
24KB
-
memory/2092-36-0x0000000000310000-0x0000000000316000-memory.dmpFilesize
24KB
-
memory/2092-35-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-30-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-22-0x0000000000310000-0x0000000000316000-memory.dmpFilesize
24KB
-
memory/2092-25-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-27-0x0000000000560000-0x0000000000566000-memory.dmpFilesize
24KB
-
memory/2092-16-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-17-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2092-21-0x0000000000200000-0x0000000000206000-memory.dmpFilesize
24KB
-
memory/2092-23-0x0000000002050000-0x0000000002185000-memory.dmpFilesize
1.2MB
-
memory/2196-9-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-15-0x0000000000170000-0x0000000000176000-memory.dmpFilesize
24KB
-
memory/2196-12-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-0-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-11-0x00000000000E0000-0x00000000000E6000-memory.dmpFilesize
24KB
-
memory/2196-32-0x00000000000C0000-0x00000000000C6000-memory.dmpFilesize
24KB
-
memory/2196-34-0x00000000000D0000-0x00000000000D6000-memory.dmpFilesize
24KB
-
memory/2196-33-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-6-0x00000000000D0000-0x00000000000D6000-memory.dmpFilesize
24KB
-
memory/2196-7-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-2-0x0000000001F90000-0x00000000020C5000-memory.dmpFilesize
1.2MB
-
memory/2196-1-0x00000000000C0000-0x00000000000C6000-memory.dmpFilesize
24KB