Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10/08/2024, 16:14
Static task
static1
Behavioral task
behavioral1
Sample
86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll
-
Size
125KB
-
MD5
86c2af84c8efb9f25c0e63828bcf04c5
-
SHA1
28b92fd091cf4c635f4e1cc2a4ec9506484cade2
-
SHA256
3a0c64d8af169569b8c6e44b59ebe3970dd9fe5af187fbfc896c205c822b7819
-
SHA512
d233f6a8f856549e1179f084fd6a307e68487ef1177d0683ba3962400112053ac46debdeadd00166e6bbd84ca160fbf534d40a9c406a9a6011e1d2736134eef5
-
SSDEEP
1536:fvGMqOBIZnLuemtj2dOuG1IYsDe28+A7Ta9VWRlHUPWcDjL0CSh8hsghBVgCPydS:fuj2It3mKW7HghBXzZHJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4268 wrote to memory of 4412 4268 rundll32.exe 84 PID 4268 wrote to memory of 4412 4268 rundll32.exe 84 PID 4268 wrote to memory of 4412 4268 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86c2af84c8efb9f25c0e63828bcf04c5_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4412
-