90f75c2c6ff0154886a11d28b71e3a693bd179dd8140dbd0716615c46e14b285

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d35cddfa87f5edc5a2cace0777564179_JaffaCakes118.dll
Size

81KB
MD5

d35cddfa87f5edc5a2cace0777564179
SHA1

1c28e3832467f358c9b35a8c1a01bbbeac7c8f6f
SHA256

90f75c2c6ff0154886a11d28b71e3a693bd179dd8140dbd0716615c46e14b285
SHA512

8f5136889ac557f327d131e6ece2ad4d42617098257f6e6c0a4050e39a084ac6890996cea9793a668b8dc86dc2bcec25ae2075fd1697a59abaa2992d9c84bf75
SSDEEP

1536:2Pt6UC/yoVtGDicvgUHEcSDdlFaMPUqVJhlgQilDISB8cAZevX/aWzj:U6U6yo7OicYUkVhUqVJhcn+kiWX

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30
PID 1716 wrote to memory of 1724	1716	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d35cddfa87f5edc5a2cace0777564179_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d35cddfa87f5edc5a2cace0777564179_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads