f704d23e05a1dc751b5ae4088a2c2d14f8484264201f3928d5736f59586984ba

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2024, 20:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ac72040a4f1c54807e1ae0e5ccae90c1_JaffaCakes118.dll
Size

28KB
MD5

ac72040a4f1c54807e1ae0e5ccae90c1
SHA1

48301546b025d26de7a3d96b19d76dda00af5dde
SHA256

f704d23e05a1dc751b5ae4088a2c2d14f8484264201f3928d5736f59586984ba
SHA512

226e22f6f2a4d31c8f4c2365cc82a1c122f6ba8434ef5e065ec3f930b137712a624fb71408d9cb1bb477290e52b3677960a6f9bebf48f9f060e61efdb8b0a903
SSDEEP

768:A14FZgY8pAM9I5cxiNNBBBQARQk3RVIZR:fFG9rIDBBQARcZR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4312	5108	rundll32.exe	84
PID 5108 wrote to memory of 4312	5108	rundll32.exe	84
PID 5108 wrote to memory of 4312	5108	rundll32.exe	84

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac72040a4f1c54807e1ae0e5ccae90c1_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac72040a4f1c54807e1ae0e5ccae90c1_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads