Analysis

  • max time kernel
    149s
  • max time network
    98s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/09/2024, 21:00

General

  • Target

    dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll

  • Size

    330KB

  • MD5

    dd0a8cf4656b730d3e912d28265dfc85

  • SHA1

    f5209e4fc0e373dd5177430b25d550968670abbf

  • SHA256

    0a0e13d03e95dd20d35ea34c749494d31c9ec6ed4147a49f7ad5f75ed53332a3

  • SHA512

    36a924ba802135b137c9133a9e0a403104a283ed8680d742aad319881262cb0425edbe3447df7fe7b35385b55bd4b49594a1d2345bbc7b3f8edf6a80c104832b

  • SSDEEP

    3072:4Rq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Cq1sFAwgwmBv3wnIgG4oAYxvU54eu

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2872
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads