Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2024, 13:06

General

  • Target

    bbd936cbd16a1ea8a7a12a77950a72ac_JaffaCakes118.dll

  • Size

    32KB

  • MD5

    bbd936cbd16a1ea8a7a12a77950a72ac

  • SHA1

    28e88008a6e0e72f39f0249f8f97adc03b3320d6

  • SHA256

    c16a3f892c8fa07be61dd01f32d4779e5c1ebe11b0cdb969869367af512e71ed

  • SHA512

    d48ebe6fdf2c79730183ec19c3de9b105323f670b55aa23ebaab5133afa10d049a4533d3b0d297d22821e18a6e7122eadbb2b0a1e51225a9e95c71217195a6c3

  • SSDEEP

    384:oLnfEqY3Rwy6j/gMx8mVo5A8An6K1QV1P6oGToTiSMQIQ8i:ozgBwz/gMx8mVcLAn6Rv6jToTifTg

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbd936cbd16a1ea8a7a12a77950a72ac_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\bbd936cbd16a1ea8a7a12a77950a72ac_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1072

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/1072-1-0x0000000010000000-0x0000000010009000-memory.dmp

          Filesize

          36KB

        • memory/1072-0-0x0000000010000000-0x0000000010009000-memory.dmp

          Filesize

          36KB