7e64c10736070aee732ab70806a3dab56a1b7dbf47c787b6b4b6758a18581059

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/01/2025, 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_610267c030485123ae08269ff7177520.dll
Size

312KB
MD5

610267c030485123ae08269ff7177520
SHA1

034fad9125a4a8ae24e80877bc2a52b7ac5521ba
SHA256

7e64c10736070aee732ab70806a3dab56a1b7dbf47c787b6b4b6758a18581059
SHA512

49954f97d69e78279ab10e38378914064110ce7483077e5219bd29b544641db49bc5b71a1a3001bef6b498390c8b1ec3aabb1698bdddb293a58d3d2e633bd637
SSDEEP

6144:pN755D+dC8SvqQpaxQOBJJ+wGnrtrYHyVDK+ow:nl8qAJ+dnxrYSVUw

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2412	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
3056	rundll32.exe
3056	rundll32.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe
2620	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2620	2412	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3060 wrote to memory of 3056	3060	rundll32.exe	30
PID 3056 wrote to memory of 2412	3056	rundll32.exe	31
PID 3056 wrote to memory of 2412	3056	rundll32.exe	31
PID 3056 wrote to memory of 2412	3056	rundll32.exe	31
PID 3056 wrote to memory of 2412	3056	rundll32.exe	31
PID 2412 wrote to memory of 2620	2412	rundll32mgr.exe	32
PID 2412 wrote to memory of 2620	2412	rundll32mgr.exe	32
PID 2412 wrote to memory of 2620	2412	rundll32mgr.exe	32
PID 2412 wrote to memory of 2620	2412	rundll32mgr.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610267c030485123ae08269ff7177520.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_610267c030485123ae08269ff7177520.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3056
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 128
      4⤵
      Loads dropped DLL
      Program crash
      PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rundll32mgr.exe

Filesize
84KB

MD5
a6ee7aab6b8f8268bf9eb763949d5c8b

SHA1
4600e17eb8fa4a11170aaa2c54d98126e58290e0

SHA256
9030a2ec813b5a70b898aacd81378c941bc5f62e78cc1a958f93106ede81228c

SHA512
00569ed578d3f0b535b0c17dc131131e4aaf73b8b5235c70fcf8de649e8a942f48a013e8c687c6abab05a8f7516dabed41309da6ce7c9eb26992183e4794afb8

Download Submit
memory/3056-1-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download
memory/3056-9-0x0000000010000000-0x0000000010052000-memory.dmp

Filesize
328KB

Download