Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 20:41
Static task
static1
Behavioral task
behavioral1
Sample
b915724335f28b0f4dac653b5ba5be59_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b915724335f28b0f4dac653b5ba5be59_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
b915724335f28b0f4dac653b5ba5be59_JaffaCakes118.dll
-
Size
28KB
-
MD5
b915724335f28b0f4dac653b5ba5be59
-
SHA1
1d1ce4b1accdcaac2753c9542e1221e476a7b31c
-
SHA256
7b07c3aff1c63a612e27f4543ca8824892bb317c0a949dbf1cea44881be5f8f2
-
SHA512
2c16f43e298675dc50a3d785de635d8c38c0a5ba257f81f3b966f04fc79fcf65e62bbfc1a80f604c7431e479840659a1743acc942df0a4856f5c35dee21aa8f9
-
SSDEEP
384:XRVtRp0zRnwnZ8oNZ4t3D4tcn7sDfBA48/KjIc3W47zawmv4vUYzdnYQeA1VkA/0:XfwqnGWM4EsDfkKUGzawmviRc+VkOuEK
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 rundll32.exe 2088 rundll32.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2088 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30 PID 1308 wrote to memory of 2088 1308 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b915724335f28b0f4dac653b5ba5be59_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b915724335f28b0f4dac653b5ba5be59_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2088
-