Analysis
-
max time kernel
134s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
20/08/2024, 00:09
Static task
static1
Behavioral task
behavioral1
Sample
ad24f156bdca47d86ea85a7ef08f6eb4_JaffaCakes118.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ad24f156bdca47d86ea85a7ef08f6eb4_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
ad24f156bdca47d86ea85a7ef08f6eb4_JaffaCakes118.dll
-
Size
363KB
-
MD5
ad24f156bdca47d86ea85a7ef08f6eb4
-
SHA1
559b40dce079c52cc114e65218c50e74420f753e
-
SHA256
07a7f7b5ee83974151a98ba1e7be6a0a40e6b9d46140d6e358abf2e7319599e0
-
SHA512
3a9d7e51d8bd942a2a2edb37dd877b27b5cf5404b108b12e4a783f00bce9df32183520458a352989821952a41de5d7a5ad00db2bc41df3e5a89922ac5a362022
-
SSDEEP
6144:qSI2Jq07K3fZXKicxXEGJyzjNs+IvkN8jUbZjZEW2a2+r:3rq1ZFc9esBG3J2aTr
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4800 wrote to memory of 3504 4800 rundll32.exe 84 PID 4800 wrote to memory of 3504 4800 rundll32.exe 84 PID 4800 wrote to memory of 3504 4800 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad24f156bdca47d86ea85a7ef08f6eb4_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ad24f156bdca47d86ea85a7ef08f6eb4_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3504
-