Analysis

  • max time kernel
    134s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 10:10

General

  • Target

    c0823119ec1268409489db82a621b607_JaffaCakes118.dll

  • Size

    7KB

  • MD5

    c0823119ec1268409489db82a621b607

  • SHA1

    aabe8f87d06f4c0c50fba7c79e2c3836e1039fda

  • SHA256

    babadd0e432eb19731d85207ad7ba56de5dbb4db3b208bb47124932c2c7570ae

  • SHA512

    8785049b8c43179db9300491d4920baf33a96403d103f4c8728da3289b4636de126ed7ca7baa0b1ed2b7463c14909e5e82a261237f1dc095d4c10c34e9b81d58

  • SSDEEP

    96:ZGtJlcddKjne2eq61NjPgz4vXMSh0GM5SSilVXuoQe7EZp6O4NyOW6AM+5nOpk5o:SWW16zg0vX3hDMkSiDH4p6P26SOPsDb2

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0823119ec1268409489db82a621b607_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0823119ec1268409489db82a621b607_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2240
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2240 -s 544
        3⤵
        • Program crash
        PID:1664
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2240 -ip 2240
    1⤵
      PID:3724

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2240-0-0x0000000000400000-0x0000000000414000-memory.dmp

            Filesize

            80KB