Analysis
-
max time kernel
93s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 14:58
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll
-
Size
928KB
-
MD5
40bf686bc8bf178d303d87a2d5af01f6
-
SHA1
729afc1fe644e77268eba36eaf6d50a333059cdf
-
SHA256
017fc6832a75b1d6730fc772c80d812d47a4e8d79f6998c8abd4696757342c01
-
SHA512
4c49277cc8e0ea881c8912c2d8cecf97a2abfa2b8642b5014de2adffc233a8707451ab24783930d92d0a4ee6ecbc6bb1e3ec65fee61b675bcd3bf57fc828dddd
-
SSDEEP
6144:zWnXe5VrTjhioRoNbn8WMdq1zQeQfp7OeULOMY+sMH4QYnO0euG+suCqA+INZMQQ:zWXe5VPFbdq1zQLfk2+lE3euFA2gDM
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 220 rundll32.exe 220 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 220 rundll32.exe Token: SeDebugPrivilege 220 rundll32.exe Token: 33 220 rundll32.exe Token: SeIncBasePriorityPrivilege 220 rundll32.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe 220 rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 848 wrote to memory of 220 848 rundll32.exe 83 PID 848 wrote to memory of 220 848 rundll32.exe 83 PID 848 wrote to memory of 220 848 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40bf686bc8bf178d303d87a2d5af01f6.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:220
-