1838befe9fbf5b75ef8bf91f9f3012e89cd1c8a92fbc368a1005a344c9b69ec2

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1360c431ca34098f1f5b2ff924395780_JaffaCakes118.dll
Size

524KB
MD5

1360c431ca34098f1f5b2ff924395780
SHA1

a5bcad8d18123a427bf6a55e3025715cf8675bce
SHA256

1838befe9fbf5b75ef8bf91f9f3012e89cd1c8a92fbc368a1005a344c9b69ec2
SHA512

3bc37f07e0d8ca9cba9d479ead3844155b0fea02fe76f32b9c92b77abdaf81d2f09488c05c68596b4eb53b30742d61ee2c71193dbdd361b256fde66a424d49ac
SSDEEP

768:8hX2W17avI3JiFU1atVwwkpJp++++++++++++++++++++++++++++++++++++++T:8NcA3JiFU1mlkpJV

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30
PID 1848 wrote to memory of 1624	1848	rundll32.exe	30

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1360c431ca34098f1f5b2ff924395780_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1360c431ca34098f1f5b2ff924395780_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads