Analysis
-
max time kernel
95s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2024, 00:30
Static task
static1
Behavioral task
behavioral1
Sample
fd7389193d3e0e8a614947481ccac953_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
fd7389193d3e0e8a614947481ccac953_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
fd7389193d3e0e8a614947481ccac953_JaffaCakes118.dll
-
Size
458KB
-
MD5
fd7389193d3e0e8a614947481ccac953
-
SHA1
ac7bd6272e21db8d1c5e49dc820fc9a38793d11b
-
SHA256
2f56f4b45f5199f95d931cec9596d41490a500548556b2fec5d6c68dc4e3050b
-
SHA512
0a8aea977bd31e742235235816c91a288380d1616b71e6922270cfee7949865d81113104b7a1aba5932b77c544fd82313a9d979279bf2c63aea76a40c311ddf9
-
SSDEEP
12288:lBSJzFIDwaDzwC+6Nit0JRFhocY0nxygbdoJFQTrDi/1d37:l8tj6Ng0J3hocY0nxJdo0Trm/
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 1584 3384 WerFault.exe 82 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4324 wrote to memory of 3384 4324 regsvr32.exe 82 PID 4324 wrote to memory of 3384 4324 regsvr32.exe 82 PID 4324 wrote to memory of 3384 4324 regsvr32.exe 82
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fd7389193d3e0e8a614947481ccac953_JaffaCakes118.dll1⤵
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\fd7389193d3e0e8a614947481ccac953_JaffaCakes118.dll2⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3384 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 353083⤵
- Program crash
PID:1584
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3384 -ip 33841⤵PID:1664