Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/09/2024, 04:01

General

  • Target

    f9abdb05c298d4956bf77c55d1d9dd41_JaffaCakes118.dll

  • Size

    21KB

  • MD5

    f9abdb05c298d4956bf77c55d1d9dd41

  • SHA1

    7c8bb7c8f14524b26dbce705f36b0855768f1bc1

  • SHA256

    5035b6f33b1ed7a66a83ab08de41ca351132146819d2cda7a2d40f0505bd99a2

  • SHA512

    70bd695aee77075039a7530565b7ac5614c1029b6a55bf4b0d57401744f6ed4e68bcc9d64c96ea118136c3a00a07fcc11ea22e7f90e7e5e2a09f966510376a2f

  • SSDEEP

    384:HIsPobW8A7yTmBbDlTKBka/HS646/lLlhInnwMZnT:H/P2AV/TuNLhmntZn

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3444
      • C:\Windows\system32\rundll32.exe
        rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9abdb05c298d4956bf77c55d1d9dd41_JaffaCakes118.dll,#1
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1236
        • C:\Windows\SysWOW64\rundll32.exe
          rundll32.exe C:\Users\Admin\AppData\Local\Temp\f9abdb05c298d4956bf77c55d1d9dd41_JaffaCakes118.dll,#1
          3⤵
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3272

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3272-0-0x0000000010000000-0x0000000010008000-memory.dmp

      Filesize

      32KB