b0fcef11353412878aeb1994908896f530737e12c09c9cbd2d0f82c3a05b84b3

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 05:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ddbedffa5380981a75c1097dcea7e93e_JaffaCakes118.dll
Size

440KB
MD5

ddbedffa5380981a75c1097dcea7e93e
SHA1

ba5afb2a427b1fdfadb420a0d5d6394c7006120a
SHA256

b0fcef11353412878aeb1994908896f530737e12c09c9cbd2d0f82c3a05b84b3
SHA512

fdcb27e242c6d57722cb1ac2a93e2159b5b2c9e1314cdc3c87fefc56cac75a4822457767c82fa89178bb3712bbe97493f9dda199e2e41f319cd03e9ec54e0aae
SSDEEP

12288:8LiKws0+IsCCP9JOK2b/y/0Y+KuVkApKKhX:86sChly/WKIDZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31
PID 1624 wrote to memory of 2412	1624	rundll32.exe	31

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbedffa5380981a75c1097dcea7e93e_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbedffa5380981a75c1097dcea7e93e_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2412-1-0x000000006D230000-0x000000006D29F000-memory.dmp

Filesize
444KB

Download
memory/2412-0-0x000000006D230000-0x000000006D29F000-memory.dmp

Filesize
444KB

Download