Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-09-2024 01:06
Static task
static1
Behavioral task
behavioral1
Sample
d56a18ff87999f419f0dd7effc765fc7_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
d56a18ff87999f419f0dd7effc765fc7_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
d56a18ff87999f419f0dd7effc765fc7_JaffaCakes118.dll
-
Size
307KB
-
MD5
d56a18ff87999f419f0dd7effc765fc7
-
SHA1
d752974953a3fe6eb7cd45edc574eb1e608e2f4d
-
SHA256
3db304500574bc6bed95af69545bea9113595f954d2a3eb41be725c7f1fa3e49
-
SHA512
50e93f6128350c68f5d527124263243e27eadcbf47b99f45a549d9a85de72a85387fec48979831d7cb44000408abd413044bef6a090b6782465fb79660d5eddd
-
SSDEEP
6144:bPwF1RlDLg5eJzzRKQC2yhsLc+tgVSzudRO5kFExBV3IOrAgRUI4PzZCT:rwXLg4Jf4fC7DzkkBVsUL29G
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30 PID 2356 wrote to memory of 2368 2356 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d56a18ff87999f419f0dd7effc765fc7_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d56a18ff87999f419f0dd7effc765fc7_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2368
-