Analysis
-
max time kernel
148s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
16-08-2024 00:27
Static task
static1
Behavioral task
behavioral1
Sample
9c3c6a4f0ee721b65fb05752a48d7e9f_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
9c3c6a4f0ee721b65fb05752a48d7e9f_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
9c3c6a4f0ee721b65fb05752a48d7e9f_JaffaCakes118.dll
-
Size
340KB
-
MD5
9c3c6a4f0ee721b65fb05752a48d7e9f
-
SHA1
eb5a90ba250d33a6a9f62c28ca2a0824b4763b96
-
SHA256
b9ed927dc9934d3be889195fcdc941ae53f95986382e5d2b1447de8d7ffcb4ab
-
SHA512
993ad32b7dcb9de3fbc9ec8adcc5b546a81e85e465b9168dfd99864c8f0ac3b6270257d5d93a7d19ddf1c400a064a76a70b000a6439601d0f10810371558ce0e
-
SSDEEP
3072:cvA1p08RqEQAIVEd2gG/vNlo0JFx/pANyCm0PQEKR/JnXRca:c206xWgGxLxWN40PDKR/JnXya
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1332 wrote to memory of 3988 1332 rundll32.exe 91 PID 1332 wrote to memory of 3988 1332 rundll32.exe 91 PID 1332 wrote to memory of 3988 1332 rundll32.exe 91
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3c6a4f0ee721b65fb05752a48d7e9f_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c3c6a4f0ee721b65fb05752a48d7e9f_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4288,i,5469445176230119590,7931734017267321834,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:81⤵PID:4004