Analysis

  • max time kernel
    134s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/07/2024, 18:31

General

  • Target

    70bfa4877c1994735064d24a986dad16_JaffaCakes118.dll

  • Size

    71KB

  • MD5

    70bfa4877c1994735064d24a986dad16

  • SHA1

    18580c81f204660207086aebb1bb4080a878daf1

  • SHA256

    6d410aa976e3cb0549d494a927d285f075c319cb35eac3bdbd1787c7f9ae1fe2

  • SHA512

    6c52ba57ba602c78b8975743115f2b5001c45e010baf0159f35b709a563572ae97fb5ff3ad3987d6f3572f091822bf6cf00a6e71b277521d706373ed75a4f4df

  • SSDEEP

    1536:BfQAl+7ovOxPOojNXX6TWqKv3Mf5JMzloBMOW1+7:dQAl+p9ZjNH6T+vMf5i2BMB+7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bfa4877c1994735064d24a986dad16_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\70bfa4877c1994735064d24a986dad16_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3904

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3904-0-0x0000000010000000-0x000000001000A000-memory.dmp

    Filesize

    40KB

  • memory/3904-1-0x0000000000F00000-0x0000000000F01000-memory.dmp

    Filesize

    4KB