Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/01/2025, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
Resource
win7-20241010-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
Resource
win10v2004-20241007-en
2 signatures
150 seconds
General
-
Target
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
-
Size
3KB
-
MD5
439100172bc8030b4e90bab20eb3ab42
-
SHA1
aa4e15fcd0fd5281d4b557242f0c5357ff698940
-
SHA256
38ef71b1b2bd102c2c66583c9d9744b2a3da46eb3c32f41134a2835df80a0158
-
SHA512
d98c40c465db481e38040e9f54c7ca5cc870e10932100c11656d93a8e6b75ff8d1792851d76f237f57d338d89ed22338d5daf65996b1373a6c041576c6670e94
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30 PID 3056 wrote to memory of 1660 3056 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1660
-