Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 15:11
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_40dbdc956e6b9106401160b10845bc1a.dll
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
JaffaCakes118_40dbdc956e6b9106401160b10845bc1a.dll
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_40dbdc956e6b9106401160b10845bc1a.dll
-
Size
48KB
-
MD5
40dbdc956e6b9106401160b10845bc1a
-
SHA1
a32601371ad74b5ad3eb97ec457cb5c17403457b
-
SHA256
d8bfa58ef3d69b90767c3bdcb36d8bcf66c84aea72a4c6c36fa0179d0095805f
-
SHA512
a7a5449d806a31be806cbb1937bcae074bf31fd923df3405f0b0835975783edf5e522ac0819b8b8e651eb1e44bb818bb48fd0b88e55ee1554f0c0ad894c69a00
-
SSDEEP
768:u09PZYWaCHCu7wL2zeIHDZzKUwpQhyEIABsDtFLR7NXWjgIuL:uurBHzG2zvD0UwQywBOBR7NXWjF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31 PID 2204 wrote to memory of 1804 2204 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dbdc956e6b9106401160b10845bc1a.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40dbdc956e6b9106401160b10845bc1a.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1804
-