16ed5b1ecaa6f99a4f4cd391cb47543776b1479dfb3abef08d35981d3bbbf9a6

Analysis

max time kernel
134s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll
Size

32KB
MD5

a9181bbf70fd5590593b040b7a802026
SHA1

4f25cb8e256e8b62b82aee62b63823e0bda4f319
SHA256

16ed5b1ecaa6f99a4f4cd391cb47543776b1479dfb3abef08d35981d3bbbf9a6
SHA512

cb82d2b1783b1774cff9adc9bc9b072c0b4c60d3cfbf506d7b1cc6cffb824e6251136540adf09cd1685139ef243e04f1f8702e20843ca3d6037cc2d42f8f79e4
SSDEEP

384:ct9+Pb79MifLVAT+6/uAB5GgP+MQyyW6tFkVXAh8:c+T79MmA5Ggwyro8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 1444	2988	rundll32.exe	84
PID 2988 wrote to memory of 1444	2988	rundll32.exe	84
PID 2988 wrote to memory of 1444	2988	rundll32.exe	84
PID 1444 wrote to memory of 4352	1444	rundll32.exe	85
PID 1444 wrote to memory of 4352	1444	rundll32.exe	85
PID 1444 wrote to memory of 4352	1444	rundll32.exe	85
PID 4352 wrote to memory of 4208	4352	rundll32.exe	86
PID 4352 wrote to memory of 4208	4352	rundll32.exe	86
PID 4352 wrote to memory of 4208	4352	rundll32.exe	86
PID 4208 wrote to memory of 4772	4208	rundll32.exe	87
PID 4208 wrote to memory of 4772	4208	rundll32.exe	87
PID 4208 wrote to memory of 4772	4208	rundll32.exe	87
PID 4772 wrote to memory of 4748	4772	rundll32.exe	88
PID 4772 wrote to memory of 4748	4772	rundll32.exe	88
PID 4772 wrote to memory of 4748	4772	rundll32.exe	88
PID 4748 wrote to memory of 1504	4748	rundll32.exe	89
PID 4748 wrote to memory of 1504	4748	rundll32.exe	89
PID 4748 wrote to memory of 1504	4748	rundll32.exe	89
PID 1504 wrote to memory of 3184	1504	rundll32.exe	90
PID 1504 wrote to memory of 3184	1504	rundll32.exe	90
PID 1504 wrote to memory of 3184	1504	rundll32.exe	90
PID 3184 wrote to memory of 4268	3184	rundll32.exe	91
PID 3184 wrote to memory of 4268	3184	rundll32.exe	91
PID 3184 wrote to memory of 4268	3184	rundll32.exe	91
PID 4268 wrote to memory of 1708	4268	rundll32.exe	92
PID 4268 wrote to memory of 1708	4268	rundll32.exe	92
PID 4268 wrote to memory of 1708	4268	rundll32.exe	92
PID 1708 wrote to memory of 2132	1708	rundll32.exe	93
PID 1708 wrote to memory of 2132	1708	rundll32.exe	93
PID 1708 wrote to memory of 2132	1708	rundll32.exe	93
PID 2132 wrote to memory of 4364	2132	rundll32.exe	94
PID 2132 wrote to memory of 4364	2132	rundll32.exe	94
PID 2132 wrote to memory of 4364	2132	rundll32.exe	94
PID 4364 wrote to memory of 3932	4364	rundll32.exe	95
PID 4364 wrote to memory of 3932	4364	rundll32.exe	95
PID 4364 wrote to memory of 3932	4364	rundll32.exe	95
PID 3932 wrote to memory of 3908	3932	rundll32.exe	96
PID 3932 wrote to memory of 3908	3932	rundll32.exe	96
PID 3932 wrote to memory of 3908	3932	rundll32.exe	96
PID 3908 wrote to memory of 2708	3908	rundll32.exe	97
PID 3908 wrote to memory of 2708	3908	rundll32.exe	97
PID 3908 wrote to memory of 2708	3908	rundll32.exe	97
PID 2708 wrote to memory of 1868	2708	rundll32.exe	98
PID 2708 wrote to memory of 1868	2708	rundll32.exe	98
PID 2708 wrote to memory of 1868	2708	rundll32.exe	98
PID 1868 wrote to memory of 4324	1868	rundll32.exe	99
PID 1868 wrote to memory of 4324	1868	rundll32.exe	99
PID 1868 wrote to memory of 4324	1868	rundll32.exe	99
PID 4324 wrote to memory of 4112	4324	rundll32.exe	100
PID 4324 wrote to memory of 4112	4324	rundll32.exe	100
PID 4324 wrote to memory of 4112	4324	rundll32.exe	100
PID 4112 wrote to memory of 2104	4112	rundll32.exe	101
PID 4112 wrote to memory of 2104	4112	rundll32.exe	101
PID 4112 wrote to memory of 2104	4112	rundll32.exe	101
PID 2104 wrote to memory of 2368	2104	rundll32.exe	102
PID 2104 wrote to memory of 2368	2104	rundll32.exe	102
PID 2104 wrote to memory of 2368	2104	rundll32.exe	102
PID 2368 wrote to memory of 2520	2368	rundll32.exe	103
PID 2368 wrote to memory of 2520	2368	rundll32.exe	103
PID 2368 wrote to memory of 2520	2368	rundll32.exe	103
PID 2520 wrote to memory of 1044	2520	rundll32.exe	104
PID 2520 wrote to memory of 1044	2520	rundll32.exe	104
PID 2520 wrote to memory of 1044	2520	rundll32.exe	104
PID 1044 wrote to memory of 2996	1044	rundll32.exe	105

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1444
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4772
      - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4748
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1504
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3184
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4268
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        16⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        17⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        18⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4112
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        19⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2104
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        21⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2520
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        22⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1044
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:2996
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        24⤵
        System Location Discovery: System Language Discovery
        
        PID:684
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        25⤵
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        26⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        27⤵
        System Location Discovery: System Language Discovery
        
        PID:1000
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:3008
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        29⤵
        System Location Discovery: System Language Discovery
        
        PID:1364
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        31⤵
        System Location Discovery: System Language Discovery
        
        PID:672
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:4004
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        33⤵
        System Location Discovery: System Language Discovery
        
        PID:2664
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:2608
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        35⤵
        System Location Discovery: System Language Discovery
        
        PID:3600
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:2768
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\rundll32.exe
        
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\a9181bbf70fd5590593b040b7a802026_JaffaCakes118.dll,#1
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:4344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads