Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
27/07/2024, 07:59
Static task
static1
Behavioral task
behavioral1
Sample
7773384a7e73d276ca5a5d037b9fefc4_JaffaCakes118.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral2
Sample
7773384a7e73d276ca5a5d037b9fefc4_JaffaCakes118.dll
Resource
win10v2004-20240709-en
windows10-2004-x64
General
-
Target
7773384a7e73d276ca5a5d037b9fefc4_JaffaCakes118.dll
-
Size
32KB
-
MD5
7773384a7e73d276ca5a5d037b9fefc4
-
SHA1
3566f0e6048f5774fbce3de156013fddac072119
-
SHA256
0e0a3d9ed60dbf7bcac3c10e3e8777f6734c8fe319ced2db98519c26030026a6
-
SHA512
aa5b58dde1f9fdf7150c267f04bfb6fa2d3aedefbc53e30ec3dd2d3046a33025c47a426319d0480315dfe728a940f9e398dab9896bc467557a9aff6183fce22f
-
SSDEEP
384:kRTa/oVUqzvTAlxPbhds/9u5+oJJpjp6fbZu7izY0DASvlqbWk:kMoOqT2xPbhCA5QZuGU0DAslQ
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\acpiec.sys rundll32.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe 4960 rundll32.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 656 Process not Found -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3356 wrote to memory of 4960 3356 rundll32.exe 87 PID 3356 wrote to memory of 4960 3356 rundll32.exe 87 PID 3356 wrote to memory of 4960 3356 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7773384a7e73d276ca5a5d037b9fefc4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7773384a7e73d276ca5a5d037b9fefc4_JaffaCakes118.dll,#12⤵
- Drops file in Drivers directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4960
-