Analysis

  • max time kernel
    94s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 00:25

General

  • Target

    fb2b4e96b025af5a4be1d09e55d2027d_JaffaCakes118.dll

  • Size

    21KB

  • MD5

    fb2b4e96b025af5a4be1d09e55d2027d

  • SHA1

    7bd6a8cfd69d10608f8e5e29a4e6f1ea91449e7e

  • SHA256

    0617cf25f7c52ac6e149384792b6ac604b2b8ea4a1facbb01fa1b548519622d8

  • SHA512

    37925ed1eba75a304f615cca7987cc21d271d93b4d375289b66fc09a5a7aee7d0804660d66e25863822a3e17ce68921d8b934a073441d42a1343237dd364ef98

  • SSDEEP

    384:8G5vD3MiN7Mf/eJ5yDQH61hZR1/9Ol2jwtnEFGmYEDcmsORUzASxfcfEyf2N+2ZG:8Gp5YceQa1hZR1/92nEFGmTAORGASxf2

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb2b4e96b025af5a4be1d09e55d2027d_JaffaCakes118.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3620
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\fb2b4e96b025af5a4be1d09e55d2027d_JaffaCakes118.dll,#1
      2⤵
      • System Location Discovery: System Language Discovery
      PID:4460

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads