Analysis

  • max time kernel
    30s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    28/09/2024, 22:49

General

  • Target

    fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll

  • Size

    224KB

  • MD5

    fd4c8104720902c41c71e7ee5a26d12f

  • SHA1

    4cd4e8af15156142a30349d31c3d4f8efeb29c2a

  • SHA256

    c7798b02a51afb96e02b17c311a6bc12203bcd6f5cd9916f508a5af7c72fc537

  • SHA512

    ae24e376082b02c0601a5132d4569bef37d891f9889d1537c6c41e52ed6fb4f236fe514da145d2d4fb1d648e2a4b2b986fcb976c0fc69ac38fc6d939ab9c2b24

  • SSDEEP

    3072:3GC6/rjVwMRbySii1O2s/+lVlgY/InIFQHxHNvK4sdkBrxj+RuozzwnJSfD0Mc:o/ryYbKivtBgIInFpNv6kBNjafcSft

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1872
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fd4c8104720902c41c71e7ee5a26d12f_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/660-2-0x0000000041AC0000-0x0000000041AF8000-memory.dmp

    Filesize

    224KB

  • memory/660-1-0x0000000041ACB000-0x0000000041AF5000-memory.dmp

    Filesize

    168KB

  • memory/660-0-0x0000000041AC0000-0x0000000041AF8000-memory.dmp

    Filesize

    224KB

  • memory/660-3-0x00000000000C0000-0x00000000000C4000-memory.dmp

    Filesize

    16KB

  • memory/660-5-0x0000000041AC0000-0x0000000041AF8000-memory.dmp

    Filesize

    224KB

  • memory/660-4-0x00000000001C0000-0x00000000001E5000-memory.dmp

    Filesize

    148KB

  • memory/660-6-0x0000000041AC0000-0x0000000041AF8000-memory.dmp

    Filesize

    224KB

  • memory/660-7-0x00000000001C0000-0x00000000001E5000-memory.dmp

    Filesize

    148KB