Analysis

  • max time kernel
    139s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/08/2024, 16:14

General

  • Target

    86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll

  • Size

    125KB

  • MD5

    86c2af84c8efb9f25c0e63828bcf04c5

  • SHA1

    28b92fd091cf4c635f4e1cc2a4ec9506484cade2

  • SHA256

    3a0c64d8af169569b8c6e44b59ebe3970dd9fe5af187fbfc896c205c822b7819

  • SHA512

    d233f6a8f856549e1179f084fd6a307e68487ef1177d0683ba3962400112053ac46debdeadd00166e6bbd84ca160fbf534d40a9c406a9a6011e1d2736134eef5

  • SSDEEP

    1536:fvGMqOBIZnLuemtj2dOuG1IYsDe28+A7Ta9VWRlHUPWcDjL0CSh8hsghBVgCPydS:fuj2It3mKW7HghBXzZHJ

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4268
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4412-0-0x0000000010000000-0x0000000010025000-memory.dmp

    Filesize

    148KB

  • memory/4412-1-0x0000000010000000-0x0000000010025000-memory.dmp

    Filesize

    148KB