2c755d734efcd727b27ffb7b8b7bc88705ec0070c86ea894a9738740aa07364d

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 08:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

aa4babb9b5e6dd74356aa2803fc4580f_JaffaCakes118.dll
Size

24KB
MD5

aa4babb9b5e6dd74356aa2803fc4580f
SHA1

c4ae4cf47c488d33249a865cc19bcfbaa30cfd4b
SHA256

2c755d734efcd727b27ffb7b8b7bc88705ec0070c86ea894a9738740aa07364d
SHA512

dca87fd1c0dbb0301ff5aa3368d215d4b207d27b1ebdbcf30c4449811d6520f74d6b38944b0d637f516b3c1260a55b9efc3cd15009f5e4b0a89688b3a708f76a
SSDEEP

192:w1ySksz0qrnrRjBN6uJNzmpL585c3qpct5UVk8UQ:tS3z0qrnNjByL585c3qpct5t8U

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30
PID 2300 wrote to memory of 1180	2300	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa4babb9b5e6dd74356aa2803fc4580f_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\aa4babb9b5e6dd74356aa2803fc4580f_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads