Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
-
Size
928KB
-
MD5
40bf686bc8bf178d303d87a2d5af01f6
-
SHA1
729afc1fe644e77268eba36eaf6d50a333059cdf
-
SHA256
017fc6832a75b1d6730fc772c80d812d47a4e8d79f6998c8abd4696757342c01
-
SHA512
4c49277cc8e0ea881c8912c2d8cecf97a2abfa2b8642b5014de2adffc233a8707451ab24783930d92d0a4ee6ecbc6bb1e3ec65fee61b675bcd3bf57fc828dddd
-
SSDEEP
6144:zWnXe5VrTjhioRoNbn8WMdq1zQeQfp7OeULOMY+sMH4QYnO0euG+suCqA+INZMQQ:zWXe5VPFbdq1zQLfk2+lE3euFA2gDM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2536 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2536 rundll32.exe Token: SeDebugPrivilege 2536 rundll32.exe Token: 33 2536 rundll32.exe Token: SeIncBasePriorityPrivilege 2536 rundll32.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe 2536 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31 PID 264 wrote to memory of 2536 264 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2536
-