4fa02686c38ff7307753f54c0e4a5fb2cf1173329f46c0fb28a7a8969d9d0ccc

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffb4ff9c4908fd2b056ed3f717d0b1a8_JaffaCakes118.dll
Size

25KB
MD5

ffb4ff9c4908fd2b056ed3f717d0b1a8
SHA1

30af8d3eb5f963f04a79c09e90d5b235532ac6cd
SHA256

4fa02686c38ff7307753f54c0e4a5fb2cf1173329f46c0fb28a7a8969d9d0ccc
SHA512

1ffb335215ec7aad97ea69bc703c8434290a10c13a75a92d4cfa1ca2700306b72abcef49c935f62efffabef2b12f0fdb58cb50388ac1cfc09b36ba7dc5ba6459
SSDEEP

768:gKcRo67T7I/RuHxIdIFtLnv8ffJUwDXC2:2T7aRwSOrkfJD7C2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30
PID 2088 wrote to memory of 2976	2088	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb4ff9c4908fd2b056ed3f717d0b1a8_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffb4ff9c4908fd2b056ed3f717d0b1a8_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2976-1-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2976-2-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download
memory/2976-0-0x0000000010000000-0x0000000010014000-memory.dmp

Filesize
80KB

Download