99e79cf58515bd9ddb5b0510c4b3566d3c1cf6b24c6a6d9e1b52409fdd482c32

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 13:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

863c846865b5adcc60bc4a0d37285ca1_JaffaCakes118.dll
Size

97KB
MD5

863c846865b5adcc60bc4a0d37285ca1
SHA1

a7c737749b872ce5970f1a3a98638e8c3107f8ad
SHA256

99e79cf58515bd9ddb5b0510c4b3566d3c1cf6b24c6a6d9e1b52409fdd482c32
SHA512

9e8fabad6ddc7b1c81ee1a11540c8921aecbe62d69b3dee408f97535cdc74b88eb6eac074d7cf7b63a12d5a83339e1e24848094d06e916851634db420e96bb57
SSDEEP

1536:eMqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRue999bo:e5OK1bzWkokkkkkkcVUwooRr999

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30
PID 1304 wrote to memory of 1572	1304	regsvr32.exe	30

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\863c846865b5adcc60bc4a0d37285ca1_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\863c846865b5adcc60bc4a0d37285ca1_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1572-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download