95539f8853e5459e50bcf81ffbeb756c51537aaa916a8118bee4ae98793aa9c1

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d368f759e18af243c8442fb2e0a75675_JaffaCakes118.dll
Size

28KB
MD5

d368f759e18af243c8442fb2e0a75675
SHA1

218dc1225c24fd244f2b65b39b0dacb4bc18aa68
SHA256

95539f8853e5459e50bcf81ffbeb756c51537aaa916a8118bee4ae98793aa9c1
SHA512

c11c59a955dec4bd82ca4b9ca703372c7ae01a3d7c5a55ba80627451081b3bc54543bc3b057e5298cf555b6884027d82423e7cb2898c64266b68ce513e48c368
SSDEEP

768:jZoBO/0GWtPXhSmK2C2C20ucKfMVLhPShJ3HgP:jZsOjWtPXhSmKZZHSh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1500	1168	rundll32.exe	88
PID 1168 wrote to memory of 1500	1168	rundll32.exe	88
PID 1168 wrote to memory of 1500	1168	rundll32.exe	88

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d368f759e18af243c8442fb2e0a75675_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\d368f759e18af243c8442fb2e0a75675_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3980,i,3239535018877284530,3457823197501312703,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
1⤵
PID:3140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads