Analysis
-
max time kernel
117s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
29-08-2024 18:18
Static task
static1
Behavioral task
behavioral1
Sample
c95cc407bac1e4e82965e832e9f1b2af_JaffaCakes118.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c95cc407bac1e4e82965e832e9f1b2af_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
c95cc407bac1e4e82965e832e9f1b2af_JaffaCakes118.dll
-
Size
88KB
-
MD5
c95cc407bac1e4e82965e832e9f1b2af
-
SHA1
b84f2f1ce2efb70323ec0d70695aabb642f3b84e
-
SHA256
e3d9a28edcf14d0ff25abd403292a4aebd8e3e7b588f7185f9fe3f3be573def9
-
SHA512
ec7f12534172f897ab8a6cbb9904418d850f69904cbcdb33551476e1871c97676d2feabd1ada331ed20dc9f57e88d57558e1790af98d9fd902bd425a2f48ad8b
-
SSDEEP
1536:gBNJ5Z/stgYqSqjleyGowsm71jjDCleauh3CkBXCfKanJfSpzfx5Fi6rT:m/syYqZjYHo6V2/uhykBXCfznk5pTiWT
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2080 rundll32.exe 2080 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30 PID 2304 wrote to memory of 2080 2304 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c95cc407bac1e4e82965e832e9f1b2af_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c95cc407bac1e4e82965e832e9f1b2af_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
-