0062a4d07536d364ef90f9c18dcd5de70a9c163c77f351e40d62f7ecbd8ca387

Analysis

max time kernel
80s
max time network
17s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7b893b71d7f90368d0230f39ade763_JaffaCakes118.dll
Size

1.1MB
MD5

ea7b893b71d7f90368d0230f39ade763
SHA1

16321aaefb98bc542e1f47fff2cc2228f947a037
SHA256

0062a4d07536d364ef90f9c18dcd5de70a9c163c77f351e40d62f7ecbd8ca387
SHA512

6fd919141b7f191832695a4bd4ce8aef6d0e19844cc421a56a3da0bd29c7afdbed22815e89ace74f7bb11c76999e62d8d71aa043e3fc28e4e9f0a2a500af710b
SSDEEP

24576:FZS/i2zlyVkNivoRfkDlZ9cgCJPO1zy5ZR4JLQZ9NT/maR4+YRYjM1P6BRinG:FZS/i2zlyMivUfClZ7C9OZy5Z+J09NL7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30
PID 1464 wrote to memory of 1156	1464	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea7b893b71d7f90368d0230f39ade763_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ea7b893b71d7f90368d0230f39ade763_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-0-0x0000000010000000-0x000000001011D000-memory.dmp

Filesize
1.1MB

Download
memory/1156-1-0x0000000010000000-0x000000001011D000-memory.dmp

Filesize
1.1MB

Download