Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
001611ad43dae3f152e2477bb381af93_JaffaCakes118.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
001611ad43dae3f152e2477bb381af93_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
001611ad43dae3f152e2477bb381af93_JaffaCakes118.dll
-
Size
102KB
-
MD5
001611ad43dae3f152e2477bb381af93
-
SHA1
19d573909448f265f4daab806c905397f4ee91aa
-
SHA256
dbe605ebbbf2464c05db69c030e72d8357e7d037f3f8b70c5fecc0d2d49b6a08
-
SHA512
0f744b42b5cf261750a898154fece7116683e1d1ae476a7ec3e205d226c218985c7e014324056ee68984c8b069309539ea8d7d0860eaff9150f876ab4a7b3f75
-
SSDEEP
1536:FcgRQNuA99UufM6ERjwepQmcU0RSQbaxFULxDnx:FcgRQNuTutEbpQeeSwaQLxDnx
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30 PID 3068 wrote to memory of 2532 3068 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\001611ad43dae3f152e2477bb381af93_JaffaCakes118.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\001611ad43dae3f152e2477bb381af93_JaffaCakes118.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2532
-