Analysis
-
max time kernel
95s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/09/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll
-
Size
2KB
-
MD5
f699aea2da36c164f7e4bab119303a38
-
SHA1
cc7eeebf3aec78b5686d1167e77545ccd74324e4
-
SHA256
0464d984d39f73e6e4b241c9e1582595f08ee81d4b90f1d7025a4fc26a1703a0
-
SHA512
53d7741b835abf92c38169989907075130db415bdb1867d19147de960f3761ac27f6f648b8bf5915e09b04553833d2e187193b7cc170b4c32ce4d96c774c7e69
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe 404 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1476 wrote to memory of 404 1476 rundll32.exe 82 PID 1476 wrote to memory of 404 1476 rundll32.exe 82 PID 1476 wrote to memory of 404 1476 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f699aea2da36c164f7e4bab119303a38_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:404
-