Analysis
-
max time kernel
94s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
8c99cc3b467fb320749f645da928f8ec_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
8c99cc3b467fb320749f645da928f8ec_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
8c99cc3b467fb320749f645da928f8ec_JaffaCakes118.dll
-
Size
9.0MB
-
MD5
8c99cc3b467fb320749f645da928f8ec
-
SHA1
4955d9ad2d14a3e7700d520828955dea5203c5df
-
SHA256
32b56235eae6625f44c8ff8b621d8af37aaa225967352780d28e12220536b6b4
-
SHA512
d23af87e136dd3e92b7ecb522bdf64df0fa5056510b5eff6b9506d01fd6d985839bce4aea3bc221e96e9193e882e4dc50dbbce1e61c2f88de1f2ee5714b13161
-
SSDEEP
768:NT5eMeSeKe0qCbc321icV7+VaEcbQ4VE+2wQk/9wFJvFjTL6b690WKi7Mk:mRLTTC7iYEcUGtZQxzR820WKi7Mk
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4704 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4100 wrote to memory of 4704 4100 rundll32.exe 86 PID 4100 wrote to memory of 4704 4100 rundll32.exe 86 PID 4100 wrote to memory of 4704 4100 rundll32.exe 86
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c99cc3b467fb320749f645da928f8ec_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8c99cc3b467fb320749f645da928f8ec_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4704
-