Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/01/2025, 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
Resource
win7-20241010-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
Resource
win10v2004-20241007-en
2 signatures
150 seconds
General
-
Target
JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll
-
Size
3KB
-
MD5
439100172bc8030b4e90bab20eb3ab42
-
SHA1
aa4e15fcd0fd5281d4b557242f0c5357ff698940
-
SHA256
38ef71b1b2bd102c2c66583c9d9744b2a3da46eb3c32f41134a2835df80a0158
-
SHA512
d98c40c465db481e38040e9f54c7ca5cc870e10932100c11656d93a8e6b75ff8d1792851d76f237f57d338d89ed22338d5daf65996b1373a6c041576c6670e94
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2808 wrote to memory of 4904 2808 rundll32.exe 83 PID 2808 wrote to memory of 4904 2808 rundll32.exe 83 PID 2808 wrote to memory of 4904 2808 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_439100172bc8030b4e90bab20eb3ab42.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4904
-