fa61946659403932db8bb401508f5caf1eac04c9d8d621502892ad2a8ce9d674

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a675961cdef7dfb4d36c09fb81d2ec82_JaffaCakes118.dll
Size

63KB
MD5

a675961cdef7dfb4d36c09fb81d2ec82
SHA1

ca4d7d16537da8ab99786d548995ca5a581647d3
SHA256

fa61946659403932db8bb401508f5caf1eac04c9d8d621502892ad2a8ce9d674
SHA512

5fd83587b206da1bf1b428899f4c19c96fd263697944ca33695ae83f01bd96d83449ea9240b2888e81f38b8531fc5d7fff4a88591233528c5b3caa6e8845bdcc
SSDEEP

1536:Z6yEOWXF+SGgy3MfX6+N9HRSUaCvQiGuW5PC4fP0X:Qc3Sy3v+N9RsCYipW1CdX

Score

7^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/736-0-0x0000000010000000-0x000000001000E000-memory.dmp	upx

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 736	2780	rundll32.exe	84
PID 2780 wrote to memory of 736	2780	rundll32.exe	84
PID 2780 wrote to memory of 736	2780	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a675961cdef7dfb4d36c09fb81d2ec82_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a675961cdef7dfb4d36c09fb81d2ec82_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/736-0-0x0000000010000000-0x000000001000E000-memory.dmp

Filesize
56KB

Download