Analysis
-
max time kernel
133s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 22:04
Behavioral task
behavioral1
Sample
bd55317f23639dbe6aef73273f8f9a4e_JaffaCakes118.dll
Resource
win7-20240729-en
3 signatures
150 seconds
General
-
Target
bd55317f23639dbe6aef73273f8f9a4e_JaffaCakes118.dll
-
Size
61KB
-
MD5
bd55317f23639dbe6aef73273f8f9a4e
-
SHA1
f0868bff7fb7278f8303ff99cf9ca828bc14afb1
-
SHA256
db96f1579ce243331ef37962fe0c6256124d4a2e97cf22f50458dc5bbea0fae1
-
SHA512
bf5fad2c5329a35009471dae972f23590ce6b49a15dc9d56502024aa5b7d469e48c443a68f563c4a7f544c18c9c2d319596cb1f7b7c6736e7e9a714541d80249
-
SSDEEP
1536:1zExMwCGQ2jgBrhYU+Nh8FHUfiWHd6Tw3ML5UPqV:1I+wCGvEBujSSf/wT6pPo
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/2432-0-0x0000000010000000-0x000000001000E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4792 wrote to memory of 2432 4792 rundll32.exe 87 PID 4792 wrote to memory of 2432 4792 rundll32.exe 87 PID 4792 wrote to memory of 2432 4792 rundll32.exe 87
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd55317f23639dbe6aef73273f8f9a4e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bd55317f23639dbe6aef73273f8f9a4e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2432
-