Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2024 12:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d1f0dd8ed0542eee20cfca0ce31b280e_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
d1f0dd8ed0542eee20cfca0ce31b280e_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
d1f0dd8ed0542eee20cfca0ce31b280e_JaffaCakes118.dll
-
Size
3KB
-
MD5
d1f0dd8ed0542eee20cfca0ce31b280e
-
SHA1
d19944d1e2db483d0c5cf4ad5de083630cfbf26d
-
SHA256
39cf18e78c039a2be18dfece5b1c7fc92b5bd3660c77c22df89e4ba8292d5cd6
-
SHA512
54372dcb820defbc064a9ef70b678aa63b1d5830ff3f45152b7919e9775b9f480fae0442b643e2c54d88631edce255aa6fb8fea3ab8ffaac0c83906f76873478
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3616 wrote to memory of 1920 3616 rundll32.exe 85 PID 3616 wrote to memory of 1920 3616 rundll32.exe 85 PID 3616 wrote to memory of 1920 3616 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f0dd8ed0542eee20cfca0ce31b280e_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3616 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d1f0dd8ed0542eee20cfca0ce31b280e_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1920
-