f79c1a928f59e23757db825d4701128978945b58ea84e1bcb8e700f1ac219422

Analysis

max time kernel
140s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 17:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b4e93e7d4b64bab27cffa3b835d6592_JaffaCakes118.dll
Size

104KB
MD5

8b4e93e7d4b64bab27cffa3b835d6592
SHA1

07e77a1c88c81461a6ec36015dcf53ed8c307292
SHA256

f79c1a928f59e23757db825d4701128978945b58ea84e1bcb8e700f1ac219422
SHA512

406ea65bb1d26e76abc03d1bd1352001f5f55742ba401fafcc4ee636e8e51f0c26b0fe3d381ce4b673b4f919785ae3e7d1cfdf2eba4807e941fcf63c15571225
SSDEEP

1536:4MqzW7JoS7qxgY96riqT2KazWkokkkkkkotV74wooRT9XDaTTloJOrOhi:45OK1bzWkokkkkkkcVUwooRhTalFS

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4940	2372	regsvr32.exe	86
PID 2372 wrote to memory of 4940	2372	regsvr32.exe	86
PID 2372 wrote to memory of 4940	2372	regsvr32.exe	86

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\8b4e93e7d4b64bab27cffa3b835d6592_JaffaCakes118.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\8b4e93e7d4b64bab27cffa3b835d6592_JaffaCakes118.dll
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4940-0-0x0000000010000000-0x000000001001A000-memory.dmp

Filesize
104KB

Download