e73be51a7decdfa047bdfa3ff6fc4ee6c414ec65009b948c24b8a67866fe5aeb

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cff98299ff53a09fb8e94644dd506d50_JaffaCakes118.dll
Size

159KB
MD5

cff98299ff53a09fb8e94644dd506d50
SHA1

7ca3fd579e24d1d3c104ac72d665dd3843d5bb78
SHA256

e73be51a7decdfa047bdfa3ff6fc4ee6c414ec65009b948c24b8a67866fe5aeb
SHA512

76ff5d25709988838a32d0e10d468280944977f5017c6c5b8e924a4c7f62417693ea31b8969c1947b1397296f9bd2b51a003ff20319e5590fdafb6eb8edec512
SSDEEP

3072:BKU9NRqDNH8gdVPkD6c2FfL26HQnZ3gXk23s5Pa+jB3fwLEx:ExNH8gmL2FfL3yJaU3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4356	5048	rundll32.exe	85
PID 5048 wrote to memory of 4356	5048	rundll32.exe	85
PID 5048 wrote to memory of 4356	5048	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cff98299ff53a09fb8e94644dd506d50_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cff98299ff53a09fb8e94644dd506d50_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4356-0-0x0000000010000000-0x0000000010016000-memory.dmp

Filesize
88KB

Download