d20b67362305f9850a7c58267c1024d0d252fc70634bb2de11d9edf7520ae1cd

Analysis

max time kernel
93s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 06:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c86f5311e66b7b8ec54def45e5a4ee4_JaffaCakes118.dll
Size

295KB
MD5

2c86f5311e66b7b8ec54def45e5a4ee4
SHA1

cd82cfded938d0c60058cf5a5539b08c462299fb
SHA256

d20b67362305f9850a7c58267c1024d0d252fc70634bb2de11d9edf7520ae1cd
SHA512

2dc0cfd8df71af2058f3885ceb2593c2d17049eb7449abc45964ce07dd9e012fcf59f5cae705c18a4331f56eec68d69a6e28831ef2a4432c7ec0b6d55137e0e2
SSDEEP

6144:HElR6SsRX80NUriiLZwNwzhsqY80vFC0aBLl0MEW0Ny:klRZuPCLbP0NSl0cyy

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
396	4360	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 4360	4976	rundll32.exe	83
PID 4976 wrote to memory of 4360	4976	rundll32.exe	83
PID 4976 wrote to memory of 4360	4976	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c86f5311e66b7b8ec54def45e5a4ee4_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\2c86f5311e66b7b8ec54def45e5a4ee4_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4360
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 580
    3⤵
    - Program crash
    PID:396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4360 -ip 4360
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4360-0-0x0000000010000000-0x00000000100A2000-memory.dmp

Filesize
648KB

Download