Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28-09-2024 02:39
Static task
static1
Behavioral task
behavioral1
Sample
fb574862fb0d74168d0d29580032aa66_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fb574862fb0d74168d0d29580032aa66_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fb574862fb0d74168d0d29580032aa66_JaffaCakes118.dll
-
Size
141KB
-
MD5
fb574862fb0d74168d0d29580032aa66
-
SHA1
231ebae08ea2d47a261953a1d24c586d1ef78365
-
SHA256
4b8b257f43a2dae228c8b9c32b88d43ca8e28d4a23cddaab8305fac2665779d7
-
SHA512
5d57f49c566eaf112a7acb6e428c2d70805eb8322bcfc4546626453537ca2b85b93754a26440676a8ff0ecbdecc376a96af438150fb78cfdad8baff6989e72d6
-
SSDEEP
3072:UECAJhkdOP17s/qaOi08OwyHxcnZGCCXl11PllV1V:UEvgOP17s/F08OaoCC1vl1V
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2492 wrote to memory of 3660 2492 rundll32.exe 82 PID 2492 wrote to memory of 3660 2492 rundll32.exe 82 PID 2492 wrote to memory of 3660 2492 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb574862fb0d74168d0d29580032aa66_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb574862fb0d74168d0d29580032aa66_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3660
-