3491f5570c7dd6e107915da3175f6c50abd9f263b390e063e072ab28701f7f26

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 00:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad263dc18a108a5c97f97ebb42fcedf3_JaffaCakes118.dll
Size

108KB
MD5

ad263dc18a108a5c97f97ebb42fcedf3
SHA1

a61190fd8e487385dedf43a0f9d783558002d60a
SHA256

3491f5570c7dd6e107915da3175f6c50abd9f263b390e063e072ab28701f7f26
SHA512

dadb330eb33fd11541a7633ba52ef77707dace1e14de8030ddb1d5174069927745265b74763b6b3c90cfa9a32cc0d8fe447f7e282aa8c2939abcb2dd7a0c38b3
SSDEEP

1536:l1quQx7tzNaOHIAT/D2XC8U8tf38T6gPY:d07tRoY/qyv8V3bgQ

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1424	4768	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 4768	3404	rundll32.exe	83
PID 3404 wrote to memory of 4768	3404	rundll32.exe	83
PID 3404 wrote to memory of 4768	3404	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad263dc18a108a5c97f97ebb42fcedf3_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad263dc18a108a5c97f97ebb42fcedf3_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4768
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4768 -s 544
    3⤵
    - Program crash
    PID:1424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4768 -ip 4768
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4768-0-0x00000000001E0000-0x00000000001FB000-memory.dmp

Filesize
108KB

Download