7ce29d90f6e47e95fed0c40fce635ebdb1b1a53ed690477f4b1749b723333e2e

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
28-01-2025 23:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_507e0345352a44025f02624aa377a816.dll
Size

284KB
MD5

507e0345352a44025f02624aa377a816
SHA1

be7487e48c8da3e1aba65ae7a0816e3594ba3c12
SHA256

7ce29d90f6e47e95fed0c40fce635ebdb1b1a53ed690477f4b1749b723333e2e
SHA512

fcdd631e95e68adebf20e84e854e9cdb4be56e1704b949b0347006368806f0585891146f4c95e1a9d6d219eb3b67f52fed58b90dcc9b5697e113c159fe67ac2e
SSDEEP

3072:W0NbrbkYHUyP9eECVWfpIhbWoVnW6IioARoKO7JurqeBTg4vRP86TvOB5n+902bT:trkYHjIWeWcd71byneDf0aZqez6ix

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2404	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
1688	rundll32.exe
1688	rundll32.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe
2388	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2388	2404	WerFault.exe
2372	1688	WerFault.exe	30

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 2188 wrote to memory of 1688	2188	rundll32.exe	30
PID 1688 wrote to memory of 2404	1688	rundll32.exe	31
PID 1688 wrote to memory of 2404	1688	rundll32.exe	31
PID 1688 wrote to memory of 2404	1688	rundll32.exe	31
PID 1688 wrote to memory of 2404	1688	rundll32.exe	31
PID 1688 wrote to memory of 2372	1688	rundll32.exe	33
PID 1688 wrote to memory of 2372	1688	rundll32.exe	33
PID 1688 wrote to memory of 2372	1688	rundll32.exe	33
PID 1688 wrote to memory of 2372	1688	rundll32.exe	33
PID 2404 wrote to memory of 2388	2404	rundll32mgr.exe	32
PID 2404 wrote to memory of 2388	2404	rundll32mgr.exe	32
PID 2404 wrote to memory of 2388	2404	rundll32mgr.exe	32
PID 2404 wrote to memory of 2388	2404	rundll32mgr.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_507e0345352a44025f02624aa377a816.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_507e0345352a44025f02624aa377a816.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 100
      4⤵
      Loads dropped DLL
      Program crash
      PID:2388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1688 -s 224
    3⤵
    - Program crash
    PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rundll32mgr.exe

Filesize
117KB

MD5
8496f6a2cbd1e710149e098e047eaee2

SHA1
dd0a84f13d385928e5270ef9b4b442150fd4a060

SHA256
dfa3498dc41116db8aec3fd24721709e90248ad9de239222f1ed31f1f9286a03

SHA512
c7a58e158ff3fbfd2bf5e2327221f6f5d24fc7abef2b48da63e98ee96efb3ff0e9d8ce8047f34f3843f385ca0607ee85a5ca7e0a8e3330366a23e99c1d9e3dd5

Download Submit
memory/1688-3-0x0000000075080000-0x00000000750CC000-memory.dmp

Filesize
304KB

Download
memory/1688-1-0x00000000750D0000-0x000000007511C000-memory.dmp

Filesize
304KB

Download
memory/1688-11-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/1688-10-0x0000000075070000-0x00000000750BC000-memory.dmp

Filesize
304KB

Download
memory/1688-5-0x00000000750D0000-0x000000007511C000-memory.dmp

Filesize
304KB

Download
memory/1688-21-0x0000000075070000-0x00000000750BC000-memory.dmp

Filesize
304KB

Download
memory/2404-13-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download