Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 09:16
Static task
static1
Behavioral task
behavioral1
Sample
c06b3a255cd18ff3b2bc5c0c19df8c40_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
c06b3a255cd18ff3b2bc5c0c19df8c40_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c06b3a255cd18ff3b2bc5c0c19df8c40_JaffaCakes118.dll
-
Size
31KB
-
MD5
c06b3a255cd18ff3b2bc5c0c19df8c40
-
SHA1
10abcf9fd424e93817867e8baec16a13301dcf30
-
SHA256
6ffeb84d349c21138815ba103bd0f06eb144948d94213fc4ce116b67799f7397
-
SHA512
bcabfa7d2269b9963782669e639423e1758544398583f4745f2cc4e6fd24d5a121a409ed624cb74d501fc86e22e4416831c82c7679cc6ebe6f4767cb7b117d7e
-
SSDEEP
384:qNNe06t9hcBVzaWOZ04c3d9EaEMFVlUCCd4sIb7jok8oxZuIdR8WIHOaoTk:eeP9hfAcHd4jZXx34WwZ3
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30 PID 1952 wrote to memory of 1756 1952 regsvr32.exe 30
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\c06b3a255cd18ff3b2bc5c0c19df8c40_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\c06b3a255cd18ff3b2bc5c0c19df8c40_JaffaCakes118.dll2⤵
- System Location Discovery: System Language Discovery
PID:1756
-