Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/09/2024, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
d1d9eaf2d4f122c5535b0814b6dcb0da_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d1d9eaf2d4f122c5535b0814b6dcb0da_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d1d9eaf2d4f122c5535b0814b6dcb0da_JaffaCakes118.dll
-
Size
207KB
-
MD5
d1d9eaf2d4f122c5535b0814b6dcb0da
-
SHA1
25a88073130def8d90528409f271ca1cf9187af9
-
SHA256
45e0f22cc3dcf7da4a8d5450b833367aee00685a8a759b985124dd7e779630b6
-
SHA512
0d947fda82959318c8621431db2882b5c1600d5e3e4afb4bf1ce59903d2f26bfd795716902cb0150e5f125cc251c2e9e6b0fee4938875434924ae7348f4281de
-
SSDEEP
6144:x3ClLdWtrn10v3D29BV8/Oj/GXn0lJ+LrTG73NxkEfeyr+Aimft8n2Vr1ufNTv3V:lRqh3OiHWrUW0rgIx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30 PID 2700 wrote to memory of 2172 2700 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1d9eaf2d4f122c5535b0814b6dcb0da_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1d9eaf2d4f122c5535b0814b6dcb0da_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2172
-