3d83a7a71fd761838ad7dd2933f82d8505e137266d7cf7c4a73f1b534020c338

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 15:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ad95b206d1c013e5a9cdba6d90287f7_JaffaCakes118.dll
Size

972KB
MD5

8ad95b206d1c013e5a9cdba6d90287f7
SHA1

a60d41379367e4c9e21402f01b54abb10e5a93d8
SHA256

3d83a7a71fd761838ad7dd2933f82d8505e137266d7cf7c4a73f1b534020c338
SHA512

c0023b6aadf4e4def9141d7200c185157e1d0d4b36c6eb13be9348079990e4f875f0739ee2eeb61e72201ee833fb7fbaa4c9b2008c9fb7e00e70a98bdc6c4d5a
SSDEEP

12288:hUdfhyND8mJUL38gP5xxckmggFCuK5S9G0UarTKeWG34u9pgp:hUAQuU78gP5xxckmgcERfG3ZM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2352	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30
PID 2444 wrote to memory of 2352	2444	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ad95b206d1c013e5a9cdba6d90287f7_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8ad95b206d1c013e5a9cdba6d90287f7_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads