Analysis
-
max time kernel
125s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06-09-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
cec7ed6e0961d64063a8c1631e106ba2_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cec7ed6e0961d64063a8c1631e106ba2_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cec7ed6e0961d64063a8c1631e106ba2_JaffaCakes118.dll
-
Size
232KB
-
MD5
cec7ed6e0961d64063a8c1631e106ba2
-
SHA1
fbd53610202405d79076ba3be91abdd77e14b919
-
SHA256
901e9776e550743dad9a300de9045aed3ee08c964d5feea4bd0bd520e6e0b371
-
SHA512
3f2bdfebef84809457cc895ec95b563f93c523aea3705e4cbc28e1df69633c99e11fef7b46a7601ecfdd01e149abbfb1cf2b272419838ddd91ce1a4d041b8ff4
-
SSDEEP
6144:BcMSPrGHXhPppJ78b0D6afOD2haJacJK/XXxLUDVeN:Bc9GHXhPFpxLxg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1124 1092 WerFault.exe 90 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3068 wrote to memory of 1092 3068 rundll32.exe 90 PID 3068 wrote to memory of 1092 3068 rundll32.exe 90 PID 3068 wrote to memory of 1092 3068 rundll32.exe 90
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cec7ed6e0961d64063a8c1631e106ba2_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cec7ed6e0961d64063a8c1631e106ba2_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1092 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 5803⤵
- Program crash
PID:1124
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1092 -ip 10921⤵PID:4556
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4404,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=1320 /prefetch:81⤵PID:2028