Analysis
-
max time kernel
93s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
02-01-2025 02:49
Behavioral task
behavioral1
Sample
JaffaCakes118_6234669a1b7b11e7487e4761e648bd29.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6234669a1b7b11e7487e4761e648bd29.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_6234669a1b7b11e7487e4761e648bd29.dll
-
Size
144KB
-
MD5
6234669a1b7b11e7487e4761e648bd29
-
SHA1
d77846cf65a557e66ad39b0f82cc95b02d4990ec
-
SHA256
66d4e792633216b95633316748d058b192de3feef5e2fb2ff404f6546598550b
-
SHA512
2b6e8a8953aaff25c009868a2bbfcdacbf5dc50cf9c4189dd470db232ea7f45d97468e976b4fdb299d229913e047eb2e265d42e09432768ab260cc2c9de17234
-
SSDEEP
3072:uCvnYA+Q3kbfAbvPG+GIYGGcfKZTtoGZ3ItC:Fp+JcbvDGIhGc+ogItC
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1844 3308 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3308 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3756 wrote to memory of 3308 3756 rundll32.exe 83 PID 3756 wrote to memory of 3308 3756 rundll32.exe 83 PID 3756 wrote to memory of 3308 3756 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6234669a1b7b11e7487e4761e648bd29.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6234669a1b7b11e7487e4761e648bd29.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3308 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 6603⤵
- Program crash
PID:1844
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3308 -ip 33081⤵PID:3184