0293588fac468a7bd6ed257226550ec493b1197e83dc30feae635623b314e299

Analysis

max time kernel
135s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 01:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69d4782a95f8328a8c99bb5cd3f892f2_JaffaCakes118.dll
Size

168KB
MD5

69d4782a95f8328a8c99bb5cd3f892f2
SHA1

be4c19043babe3212e074c1b09419da80b4d32cd
SHA256

0293588fac468a7bd6ed257226550ec493b1197e83dc30feae635623b314e299
SHA512

1e1619ec1e31e79d834e9522cea8fe7118f04d01e0423f9fcb5159d5c57d94db10436c996958b0db7e154e9a794182720bc6c363ce569bb63ff8d738379cd32b
SSDEEP

3072:fuELj2Jlu92WHULb9xRhBdiFeYC4zwFv++P6KcoZ+G:2EWusW2xnB08vHFPP6Y+G

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2160	2972	regsvr32.exe	86
PID 2972 wrote to memory of 2160	2972	regsvr32.exe	86
PID 2972 wrote to memory of 2160	2972	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\69d4782a95f8328a8c99bb5cd3f892f2_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\69d4782a95f8328a8c99bb5cd3f892f2_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2160-0-0x0000000010000000-0x000000001002C000-memory.dmp

Filesize
176KB

Download