Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    24-06-2024 19:08

General

  • Target

    0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll

  • Size

    311KB

  • MD5

    0a52a0860a41f884a6e904ebabd3f582

  • SHA1

    7a34df08e8fab7f8f45e5b3ca2c50356f7e29156

  • SHA256

    829f64eb9cb838d529a83e6b480fc43f40fd119a582fe02cdd0c992b64318821

  • SHA512

    c34367b30dd8d5f985fb7f6137acaf8c437eb86802455b9746e27d918dd8e61fead888206755c20eccd45e10d5b3a57a685fdb94bda4fc37eb9443fa94da0f89

  • SSDEEP

    3072:jDKpt9sSR0HUHPwZWLnWVfEAzV2IJIwTBftpmc+z+f3Q0D:jDgtfRQUHPw06MoV2nwTBlhm87

Score
10/10

Malware Config

Signatures

  • Yunsip

    Remote backdoor which communicates with a C2 server to receive commands.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0a52a0860a41f884a6e904ebabd3f582_JaffaCakes118.dll,#1
      2⤵
        PID:2040

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads