1a5dcab0344ea4c94dd76efb23804b10159f14a38892238512b4b5b1b8f87a3d

Analysis

max time kernel
139s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 03:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8d260611b10f5a48d27c97b8cbb2a543_JaffaCakes118.dll
Size

22KB
MD5

8d260611b10f5a48d27c97b8cbb2a543
SHA1

9f812e2ad1e6bf1ec7c8625231d8502fe9ee9bb8
SHA256

1a5dcab0344ea4c94dd76efb23804b10159f14a38892238512b4b5b1b8f87a3d
SHA512

807be11a0e8f29ade3490d1db4e8036499565f4c3c466e12e99a2b4700a0cdf36f1a1a48eea0c3fb3a05fcf2e454dc3df9d17eaa4284baa204dfa5734a235669
SSDEEP

384:mVW/WgyGOuEOiuQ3lQ+fXqXW1jg/DpGRAAtMMKMTXaSbAupxgQyUAEbvVb4OG/lJ:c7vdlQ+fqXWhgLpGRRZTq3CuQlAEbNb6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5060	C1A042B0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\C1A042B0.exe	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 3220	3308	rundll32.exe	84
PID 3308 wrote to memory of 3220	3308	rundll32.exe	84
PID 3308 wrote to memory of 3220	3308	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d260611b10f5a48d27c97b8cbb2a543_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\8d260611b10f5a48d27c97b8cbb2a543_JaffaCakes118.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3220
- - C:\Windows\SysWOW64\C1A042B0.exe
    C:\Windows\system32\C1A042B0.exe
    3⤵
    - Executes dropped EXE
    PID:5060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\C1A042B0.exe

Filesize
13KB

MD5
452726780ed345118eed84468942bf50

SHA1
bd82f08a261eb215bb39b57ebf56b314873b7d3a

SHA256
14bad1ae53ac1f399f3149f3fd630330159766e82d49271bcc70cbffdb740a2b

SHA512
4b1d046301209ad5c3b19c4fcaba0457e5aee41b6c9e2ee775b27d8de0ea3f8410b2127bf1dce9398f45cc0da214f17d2f909b3c0c1b9fb735498b9fe7886c36

Download Submit
memory/3220-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/3220-1-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Filesize
4KB

Download
memory/5060-4-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download