Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
27-01-2025 23:29
Behavioral task
behavioral1
Sample
JaffaCakes118_44aac9a014e58ba2c70cfa9594a91c7a.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
JaffaCakes118_44aac9a014e58ba2c70cfa9594a91c7a.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_44aac9a014e58ba2c70cfa9594a91c7a.dll
-
Size
98KB
-
MD5
44aac9a014e58ba2c70cfa9594a91c7a
-
SHA1
23a193c79f0e99a9a9a1e05b813389a2f807901b
-
SHA256
cea66668dda11f93a75666f99ad019f59fa5e9f945a150ada6360bdb92fbeb92
-
SHA512
a8599180dcc4dbd4010c2e75422a890c2b81b69ac1a8443526956e9fddbed8f93a943318cc46784cf0273117e96e6116a52247996a9dc536465b2dd6759c4f1f
-
SSDEEP
3072:MEgLGv/jAc2U0oQIt1cdq/aEd/LYkUa7UE:LgLy/jYs1k2D/L3Uaw
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30 PID 2680 wrote to memory of 2932 2680 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44aac9a014e58ba2c70cfa9594a91c7a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_44aac9a014e58ba2c70cfa9594a91c7a.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2932
-