Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/08/2024, 10:10

General

  • Target

    c0823119ec1268409489db82a621b607_JaffaCakes118.dll

  • Size

    7KB

  • MD5

    c0823119ec1268409489db82a621b607

  • SHA1

    aabe8f87d06f4c0c50fba7c79e2c3836e1039fda

  • SHA256

    babadd0e432eb19731d85207ad7ba56de5dbb4db3b208bb47124932c2c7570ae

  • SHA512

    8785049b8c43179db9300491d4920baf33a96403d103f4c8728da3289b4636de126ed7ca7baa0b1ed2b7463c14909e5e82a261237f1dc095d4c10c34e9b81d58

  • SSDEEP

    96:ZGtJlcddKjne2eq61NjPgz4vXMSh0GM5SSilVXuoQe7EZp6O4NyOW6AM+5nOpk5o:SWW16zg0vX3hDMkSiDH4p6P26SOPsDb2

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0823119ec1268409489db82a621b607_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0823119ec1268409489db82a621b607_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:484

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/484-3-0x0000000000170000-0x0000000000184000-memory.dmp

          Filesize

          80KB

        • memory/484-2-0x0000000000160000-0x0000000000174000-memory.dmp

          Filesize

          80KB

        • memory/484-1-0x0000000000160000-0x0000000000174000-memory.dmp

          Filesize

          80KB

        • memory/484-0-0x0000000000160000-0x0000000000174000-memory.dmp

          Filesize

          80KB

        • memory/484-4-0x0000000000170000-0x0000000000172000-memory.dmp

          Filesize

          8KB