Analysis
-
max time kernel
16s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
24-08-2024 20:12
Behavioral task
behavioral1
Sample
bf51f6ddc60918e5f7e8f6168bbd0e52_JaffaCakes118.dll
Resource
win7-20240729-en
windows7-x64
3 signatures
150 seconds
General
-
Target
bf51f6ddc60918e5f7e8f6168bbd0e52_JaffaCakes118.dll
-
Size
193KB
-
MD5
bf51f6ddc60918e5f7e8f6168bbd0e52
-
SHA1
b66888f2b891e842bd6ef3721d984154cb653c2c
-
SHA256
55bd7f3408f179ebb1077ec0cbbb564c5683b5c0b6b0d02fb76d9e1198ec19fb
-
SHA512
667ed2d015e92f39330bbe019524e16d1492fe81eaef6fddd7091b7053c0d75e31c7fc29c6037e9178d031d3fb6b97de108a76ed9153c603359440d0c3ab8e03
-
SSDEEP
3072:7oUTB7x2CCDjZcK05FS7s/1ZFOHdos+thwhRfM4zErMtCwBwgUoWq6Iewcg0:7okx2vh45osDFOIwj608AWq6R7g0
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2332-1-0x0000000075300000-0x0000000075379000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29 PID 2328 wrote to memory of 2332 2328 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf51f6ddc60918e5f7e8f6168bbd0e52_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bf51f6ddc60918e5f7e8f6168bbd0e52_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2332
-