f7a6ffc22ac1802189eabb6b68c0e188cdabf99c4c0faece251066e12eb98b34

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 04:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3de42e46a7000da82d5d8f57b54422bf_JaffaCakes118.dll
Size

40KB
MD5

3de42e46a7000da82d5d8f57b54422bf
SHA1

8b40cf9c8f8b6ad8f3f71206c1e6d6b132f8518e
SHA256

f7a6ffc22ac1802189eabb6b68c0e188cdabf99c4c0faece251066e12eb98b34
SHA512

0f8a07f85c7dc4dfff1776cacd6ca958ec16aa658c9d4c1a877cf186faf7fc0bbe99da7d29a9d5b773b00589735d81a04e88a072bc60cce3423963e44297f973
SSDEEP

768:SRLdudxs5i7ClOs9IulGlqOCDz9ExnTibMcq5Zh91zKhnjZU1jfyrI48+r:SxGxii7ClOs9lGIfaTibMcq5F10j+oIS

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1504-0-0x0000000010000000-0x000000001003A000-memory.dmp	upx

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3272	1504	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 1504	1392	rundll32.exe	83
PID 1392 wrote to memory of 1504	1392	rundll32.exe	83
PID 1392 wrote to memory of 1504	1392	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\3de42e46a7000da82d5d8f57b54422bf_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\3de42e46a7000da82d5d8f57b54422bf_JaffaCakes118.dll,#1
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1504
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 620
    3⤵
    - Program crash
    PID:3272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1504 -ip 1504
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-0-0x0000000010000000-0x000000001003A000-memory.dmp

Filesize
232KB

Download
memory/1504-1-0x0000000000930000-0x0000000000933000-memory.dmp

Filesize
12KB

Download