3843163cd90c4930c7bd050d8d546284c3dc18cfb5aa4b2a60612c10190258a4

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a69f59470723f002f245e0fd70de024f_JaffaCakes118.dll
Size

20KB
MD5

a69f59470723f002f245e0fd70de024f
SHA1

bbf5624e6225123b70af013c4f30c0d8f84feead
SHA256

3843163cd90c4930c7bd050d8d546284c3dc18cfb5aa4b2a60612c10190258a4
SHA512

3799009744e0144ce46cbca0bd0e2f45cc785ae9bba5c1e3bb15dcbb44f2c678b2e50c0166abec2d6f2f45c428ad8eddccc573322793a0ad1205d43707e9208f
SSDEEP

384:zSG/2Jp+C6QhtmruxCcdIL+0XplvCAu8UaWHuqaTlX0wG:zfYh2oCtpXPvx2OqaewG

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2324	rundll32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2324	rundll32.exe
2324	rundll32.exe
2324	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31
PID 3048 wrote to memory of 2324	3048	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a69f59470723f002f245e0fd70de024f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a69f59470723f002f245e0fd70de024f_JaffaCakes118.dll,#1
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\D22D.tmp

Filesize
20KB

MD5
1d387c05c62eaeaf539f8cfab3b93316

SHA1
9ac67aecb383c4e8371a1242a2bb47ad6e50803c

SHA256
8ffd8fa8e1a1cd53188904cd02dfdcd689b692dcdb1a422b4b824d71b01d3c4f

SHA512
442812286bb34d3db585c7a290609412a15927a1b660b71193f3fab88343e44e697a14d7aaff31770b3bc79a8d56ace549c12070d8929b3b600b6db3e1c12fcf

Download Submit
memory/2324-5-0x0000000000110000-0x000000000011C000-memory.dmp

Filesize
48KB

Download