Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2024 06:35
Static task
static1
Behavioral task
behavioral1
Sample
eac50b2ac9f6f7b7c3af814d64e46852_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eac50b2ac9f6f7b7c3af814d64e46852_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
eac50b2ac9f6f7b7c3af814d64e46852_JaffaCakes118.dll
-
Size
33KB
-
MD5
eac50b2ac9f6f7b7c3af814d64e46852
-
SHA1
fde300bff828daa53da6b4b91f7e635de214c50f
-
SHA256
2d91670dd7acfbc5c96a5ad6d93adc7c219ae0446d10f6451dd4afad7f95d764
-
SHA512
a80de37e29d31b489e2c7b887973201ddd5bdc8f128989843961242e70e890bfccb4347e09c20a786ecaf1951994f18591bda0fe5b1328656edaaef090cd6ab1
-
SSDEEP
384:/g95Ar6n19NL9/1iN06md9eE4iUGKUInCxC6o77epQ+9CdbawYJFJ0CRM59PJ:onAc/2IfZ4ZUInWo7cQkCphqDhR89PJ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1408 wrote to memory of 5012 1408 rundll32.exe 89 PID 1408 wrote to memory of 5012 1408 rundll32.exe 89 PID 1408 wrote to memory of 5012 1408 rundll32.exe 89
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eac50b2ac9f6f7b7c3af814d64e46852_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eac50b2ac9f6f7b7c3af814d64e46852_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4436,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:81⤵PID:5032