Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/07/2024, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll
-
Size
100KB
-
MD5
6f7c4115bc5ec8d4d580912908015c2c
-
SHA1
3ec98c22cd19f745d96033ac1fd69b0b392ba7e8
-
SHA256
ccc68c102deebf00ff9a48f8de41d08782af332bf09aafd00b88815e0dbf383c
-
SHA512
271a59062cecee241946ac52f6d19aa3c94d760d933139fe999ea479b3d574696a0e21cc82ec19e0592e34a181280ec1d0fef74c1ae4b466cfbbfccae5b3cd9a
-
SSDEEP
1536:NxJ/UblGuKOsKuMVp6y6ij58K46CweMrGhNucj0rVinxTHyn:TJYjnU8p6y6pn6ixTSn
Malware Config
Signatures
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ÚPEõzåÎÚð7KàÎÚð7KàÎÚÐç{åÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚð7KàÎÚ\pARAMETERS\ServiceDll = "%sYSTEMrOOT%\\sYSTEM32" rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30 PID 668 wrote to memory of 2224 668 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6f7c4115bc5ec8d4d580912908015c2c_JaffaCakes118.dll,#12⤵
- Server Software Component: Terminal Services DLL
- System Location Discovery: System Language Discovery
PID:2224
-