Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 08:14
Behavioral task
behavioral1
Sample
c051277630bb8a493165f8709c3b8c94_JaffaCakes118.dll
Resource
win7-20240705-en
3 signatures
150 seconds
General
-
Target
c051277630bb8a493165f8709c3b8c94_JaffaCakes118.dll
-
Size
63KB
-
MD5
c051277630bb8a493165f8709c3b8c94
-
SHA1
753f63c7ddbe483c760ca754107083fb7fccdc21
-
SHA256
b7058bc3a2dfd729f79ebfcbb18f1fa600072d3d2d7d2678091f1ffb1cb92077
-
SHA512
7628376c5ea6bf5a52f87952152f9194af28ec9eefcfb71b6c68a7b8ba7298a7e0bec2f862d404f55cd9b60baff353272476352e32c5f9e58d74bf1bbd6091b0
-
SSDEEP
1536:Bm1NGJVGHY1sdZyHrX2aYxykpFGoO3jRRYLDrU:kX0Vd1sdZKr7o7pFE3lRYLDg
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2168-0-0x0000000010000000-0x0000000010013000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30 PID 1676 wrote to memory of 2168 1676 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c051277630bb8a493165f8709c3b8c94_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c051277630bb8a493165f8709c3b8c94_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2168
-