Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/10/2024, 20:46

General

  • Target

    4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll

  • Size

    168KB

  • MD5

    4ef048492244f4133c3d706c7637d410

  • SHA1

    4dcb034f48036747c5da9718a69a63e8bc4476fe

  • SHA256

    57b240b0d5f67ecea128750855a72ee96e9e4ace6cbde11d1c9808d8b350ad11

  • SHA512

    68ba48a61a6d4d686e598e375d014ebf83318d7011566c9c3e5b0c1497a76c29ddcf5edd62081fb89d1928136ca8916e3c37eb3405c43798641baf4c200f1946

  • SSDEEP

    3072:lC54Wp/CQb6rfAsbbrMbvT0q8O1cZPzQ7IXMBc+AMP+QfQEhxFyVU7rQDjz:leRp/LI9wvP6bQ7yMP+DE827rM

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 13 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\4ef048492244f4133c3d706c7637d410_JaffaCakes118.dll
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      PID:3532

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/3532-0-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/3532-1-0x000000001001F000-0x0000000010020000-memory.dmp

          Filesize

          4KB

        • memory/3532-2-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/3532-3-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/3532-4-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/3532-5-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB

        • memory/3532-6-0x0000000010000000-0x000000001003B000-memory.dmp

          Filesize

          236KB