Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 14:58
Behavioral task
behavioral1
Sample
JaffaCakes118_40c05e4e17a800f67d194f0fe0cd556b.dll
Resource
win7-20240903-en
3 signatures
150 seconds
General
-
Target
JaffaCakes118_40c05e4e17a800f67d194f0fe0cd556b.dll
-
Size
56KB
-
MD5
40c05e4e17a800f67d194f0fe0cd556b
-
SHA1
3715c9b1934414146388c617e65394afa82ec891
-
SHA256
d4f49ae46247ab74a0ce25054142248d1f2a9ea9e94f24c1a4d87c3c6cbc8079
-
SHA512
e75bf2a02d7807e33332fea0f146d8e020a0e4d19cff7a95a6a055bc93081f2dd1b1b441cd568f3448be40e3b641ec637c22ce8dce2617393d9474ee2473f5da
-
SSDEEP
768:9xBtKtqyLUkpLKq3LeOZ2mmlb6cE/pYgU7yg7d4rJtpyiDCu6THqx5ARanBullfE:96UmmlGlitFiJ3jWpTqkTlsKQ
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2872-0-0x0000000010000000-0x000000001000D000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30 PID 2036 wrote to memory of 2872 2036 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c05e4e17a800f67d194f0fe0cd556b.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c05e4e17a800f67d194f0fe0cd556b.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2872
-