Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/09/2024, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
cf1de69b09bb81aabd425a4db2bb7b81_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cf1de69b09bb81aabd425a4db2bb7b81_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
cf1de69b09bb81aabd425a4db2bb7b81_JaffaCakes118.dll
-
Size
106KB
-
MD5
cf1de69b09bb81aabd425a4db2bb7b81
-
SHA1
7131656115f41bceadc2b8e74acd99f4ab5abe20
-
SHA256
03c3bd3c7992067bc72f3cb7ea2f5eb99f03fc773cae9173cbae0cb24bf6ca24
-
SHA512
923fd68b3c7fd3d6b8a6a397b18ae71949da3ff128ec07690fd49ad45b55679142df9558774639f2c0d0c5174948fee4653e9ad5372b18e95a3e03005c8ffa22
-
SSDEEP
3072:z7Az8ZUob2eUtcHqIjvToAeNsu9BGnMgf5g297F9MSN:nAzToCcHqIDeNsu9gMgf5f9r
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 396 wrote to memory of 4548 396 rundll32.exe 83 PID 396 wrote to memory of 4548 396 rundll32.exe 83 PID 396 wrote to memory of 4548 396 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf1de69b09bb81aabd425a4db2bb7b81_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cf1de69b09bb81aabd425a4db2bb7b81_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4548
-