f520e6e0cc861c7bb44a48d16a8ebf4cd9adbd1bcdd7a1e18c5db3ce16f86e5a

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

834868c00a03b2eae8cf7c472b3bd691_JaffaCakes118.dll
Size

293KB
MD5

834868c00a03b2eae8cf7c472b3bd691
SHA1

da85c6220c882482768829f63ef0ee6f491eeef8
SHA256

f520e6e0cc861c7bb44a48d16a8ebf4cd9adbd1bcdd7a1e18c5db3ce16f86e5a
SHA512

f41f0eee6e3a0075702598e8e05dbcc82467693802d2b5bb8e86256dd25059d8c5436a1d50d119f7e7bc63fd69bdd9a51a5c7d41cbf477d96682be4dc6016fe2
SSDEEP

3072:pwixuGbPJ4eNTB/KSOpFei2MHDPl0Ic4ttPEJES+FNp/bjFTkjqJ+hn5Mj32qVU/:2Sa2BSSiH2UnlTk24DGXU2Oo8Ge

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30
PID 2652 wrote to memory of 1736	2652	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\834868c00a03b2eae8cf7c472b3bd691_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\834868c00a03b2eae8cf7c472b3bd691_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads