Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
976dd348bf2787e17962fd2daf79b8e4_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
976dd348bf2787e17962fd2daf79b8e4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
976dd348bf2787e17962fd2daf79b8e4_JaffaCakes118.dll
-
Size
270KB
-
MD5
976dd348bf2787e17962fd2daf79b8e4
-
SHA1
87733aa500f2f6766bef7b971cfe5ea79261eb33
-
SHA256
074993e860b423da514a0c90782b6f5df26587a35ae44c9af570cc2d4acd91f7
-
SHA512
4c2d88e0b672a49ce3f65aa73201baf21db9531c9d2d21ac376bac3bea9401875e095f33fe05342dd8195ec8100f5ec09c24a1af38132348e1c0bf512267c4be
-
SSDEEP
6144:gOwB0AyQstKDkcN75/gYUYT/HTfkNQeeaQeeEQeesQeeKCQeehQee0J2ViVvPAr7:vkkytgYUYTva2u/
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1696 2224 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 3024 wrote to memory of 2224 3024 rundll32.exe 31 PID 2224 wrote to memory of 1696 2224 rundll32.exe 32 PID 2224 wrote to memory of 1696 2224 rundll32.exe 32 PID 2224 wrote to memory of 1696 2224 rundll32.exe 32 PID 2224 wrote to memory of 1696 2224 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\976dd348bf2787e17962fd2daf79b8e4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\976dd348bf2787e17962fd2daf79b8e4_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2843⤵
- Program crash
PID:1696
-
-