Analysis
-
max time kernel
149s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/09/2024, 21:00
Static task
static1
Behavioral task
behavioral1
Sample
dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll
-
Size
330KB
-
MD5
dd0a8cf4656b730d3e912d28265dfc85
-
SHA1
f5209e4fc0e373dd5177430b25d550968670abbf
-
SHA256
0a0e13d03e95dd20d35ea34c749494d31c9ec6ed4147a49f7ad5f75ed53332a3
-
SHA512
36a924ba802135b137c9133a9e0a403104a283ed8680d742aad319881262cb0425edbe3447df7fe7b35385b55bd4b49594a1d2345bbc7b3f8edf6a80c104832b
-
SSDEEP
3072:4Rq1sFAd2gQ5PmBvNZwnnq1gn2RvoXiDzAYgrO1v2F5j8eFu:Cq1sFAwgwmBv3wnIgG4oAYxvU54eu
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2872 wrote to memory of 4036 2872 rundll32.exe 83 PID 2872 wrote to memory of 4036 2872 rundll32.exe 83 PID 2872 wrote to memory of 4036 2872 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dd0a8cf4656b730d3e912d28265dfc85_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4036
-