095d05765d103a28293839b5456f5425741d05412d2839c920fe9f53c372f98a

Analysis

max time kernel
13s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffa0e4b3a4cbc68c97b0d665b73fab84_JaffaCakes118.dll
Size

110KB
MD5

ffa0e4b3a4cbc68c97b0d665b73fab84
SHA1

c1ddc6703438b48606d60ecef85823fd18c2da64
SHA256

095d05765d103a28293839b5456f5425741d05412d2839c920fe9f53c372f98a
SHA512

a216ace5521a7aec8cb7b35efd8de846d2109fd40be6f45d47c6dd879430f024432d4051d2639bc79534918dd3d4976585363b7f35e0fdb8b79d14429cb7525d
SSDEEP

1536:qlqcQUbBWUHmT7JRwwGC4D04S/1n3YOeE5BiGqCicZjzdOPclmbff4Q5:sJbBtHmpmLC4Y4E+8aCFZjBONffP

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29
PID 280 wrote to memory of 1020	280	rundll32.exe	29

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffa0e4b3a4cbc68c97b0d665b73fab84_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\ffa0e4b3a4cbc68c97b0d665b73fab84_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1020-0-0x00000000001D0000-0x00000000001F1000-memory.dmp

Filesize
132KB

Download