Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
17-08-2024 18:35
Static task
static1
Behavioral task
behavioral1
Sample
a3ab2e4df1d740e8af1106734afe3050_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a3ab2e4df1d740e8af1106734afe3050_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
a3ab2e4df1d740e8af1106734afe3050_JaffaCakes118.dll
-
Size
40KB
-
MD5
a3ab2e4df1d740e8af1106734afe3050
-
SHA1
932f8e6b6e373f8d36461e86cb66c9325f818e04
-
SHA256
68ef7c9462804040a2e878bd1ff94a5403a8a5d5b460e3c68d5a115b51404074
-
SHA512
5d4a12086317989ba822e6bb42a5d080ea1fb66c131b9d2a4ef101f6cb467d1867411b21db26ea160c6082271541dfac4bea43134dfd8e2ab5ac6b4632e52861
-
SSDEEP
384:QgkkljT8yRUtgk7MpigVXDTb/+3ot+fMUFp8KXEyYycSzPgWYXiWAtsZgTjE:QgTHZpigVXDTbW3ot+flFxcgPwiNsZgM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2312 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4636 wrote to memory of 2312 4636 rundll32.exe 84 PID 4636 wrote to memory of 2312 4636 rundll32.exe 84 PID 4636 wrote to memory of 2312 4636 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ab2e4df1d740e8af1106734afe3050_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a3ab2e4df1d740e8af1106734afe3050_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2312
-