09b83921de54c790096e22e36e8dd519fbf66c99726dd69f58074ba93e54b0fc

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/08/2024, 20:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

838281031e26762344a64626e1684cb6_JaffaCakes118.dll
Size

52KB
MD5

838281031e26762344a64626e1684cb6
SHA1

83367697ec0318072eb68ca9b1c1a07183849c87
SHA256

09b83921de54c790096e22e36e8dd519fbf66c99726dd69f58074ba93e54b0fc
SHA512

29a61dddb28c793ec41c49b71ced2c7ddf33ca4424d67c69552c67febacbcd9b25914cef7c678c47d6fe3ceab3b4829f3089307b7a8cc7029a5e0abbfcdc8b6a
SSDEEP

768:2788TBHR7oOj33NvwSFbyx9GGB8oYMW3NR:2788TBHldxtbAcLoTW3v

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30
PID 1824 wrote to memory of 2240	1824	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\838281031e26762344a64626e1684cb6_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\838281031e26762344a64626e1684cb6_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads