Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
19-08-2024 17:44
Static task
static1
Behavioral task
behavioral1
Sample
abf7def8556b384d35270a5673bc939e_JaffaCakes118.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
abf7def8556b384d35270a5673bc939e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
abf7def8556b384d35270a5673bc939e_JaffaCakes118.dll
-
Size
804KB
-
MD5
abf7def8556b384d35270a5673bc939e
-
SHA1
416337b3ec4c997af789e6024f5186bc0261c613
-
SHA256
8f96249c2c4de4b0f3b1a045427e56dde5be4c05e176bde84f7b40a268d1c50b
-
SHA512
2f010c902956ccff8c0f07ddf3f40bb865e47138cb2c1582bdf02a99c58c6461093d52d6fcb82c235beabfadd6fa9eae651f31e60ba9516ba25101b1fa149baf
-
SSDEEP
12288:2z92u4NCR9K/yl4sEljm8bYL49ibGQf6:2z92q0yysqmOsJlf6
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe -
Suspicious use of SetWindowsHookEx 56 IoCs
pid Process 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe 2572 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30 PID 2420 wrote to memory of 2572 2420 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\abf7def8556b384d35270a5673bc939e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\abf7def8556b384d35270a5673bc939e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2572
-