4ca7f144aebfa5eca9400066cdaa493fdb3a927e10df8f827c4059977979a0fc

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 12:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8622058cf310addf596f2d3e24e159e0.dll
Size

280KB
MD5

8622058cf310addf596f2d3e24e159e0
SHA1

913945c1d59a01bbafafed4eb309dba4c578e86c
SHA256

4ca7f144aebfa5eca9400066cdaa493fdb3a927e10df8f827c4059977979a0fc
SHA512

0f4779d4d74765df11456ab7417328f2aab6d7a0881e1b44a85d75735a6233fb56006d4a25c59e61974d25abf6b6ae39e029b4ad9d7dd52c5f3e661559f19936
SSDEEP

3072:cn4cV8gf2u41Z5tKlwKWSLCgOhZpZ+b6v4XbMjX58z1M3TZRrOsageiqR8J/Ckyc:u4y8gOl2Em2Q6wrMlSK6meiWkJH7J

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2752	rundll32mgr.exe

Loads dropped DLL 9 IoCs

pid	Process
2720	rundll32.exe
2720	rundll32.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe
2800	WerFault.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rundll32mgr.exe	rundll32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2800	2752	WerFault.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32mgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2664 wrote to memory of 2720	2664	rundll32.exe	30
PID 2720 wrote to memory of 2752	2720	rundll32.exe	31
PID 2720 wrote to memory of 2752	2720	rundll32.exe	31
PID 2720 wrote to memory of 2752	2720	rundll32.exe	31
PID 2720 wrote to memory of 2752	2720	rundll32.exe	31
PID 2752 wrote to memory of 2800	2752	rundll32mgr.exe	32
PID 2752 wrote to memory of 2800	2752	rundll32mgr.exe	32
PID 2752 wrote to memory of 2800	2752	rundll32mgr.exe	32
PID 2752 wrote to memory of 2800	2752	rundll32mgr.exe	32

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8622058cf310addf596f2d3e24e159e0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8622058cf310addf596f2d3e24e159e0.dll,#1
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\rundll32mgr.exe
    C:\Windows\SysWOW64\rundll32mgr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2752 -s 92
      4⤵
      Loads dropped DLL
      Program crash
      PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\rundll32mgr.exe

Filesize
186KB

MD5
d1cf33b3fb134d96475c1e6d3df0f341

SHA1
26cb92871856fc3e903e432e638cd09f7d64fca5

SHA256
52515cc80821a94d293e12fa06b546b90e1c66dcfc7af74beacfb5e97ca2c6fa

SHA512
1df8810ab5948813eefef7264c8dfb7b40f8ddb6f7d21ce203c4afef8ef28748fc80d3dc1560c16a05fcae543b8cd1e7655cd6102286accc6865c47b69ad54a1

Download Submit
memory/2720-6-0x00000000001F0000-0x000000000022A000-memory.dmp

Filesize
232KB

Download
memory/2720-2-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/2720-0-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/2720-4-0x0000000010000000-0x0000000010047000-memory.dmp

Filesize
284KB

Download
memory/2720-12-0x00000000001F0000-0x000000000022A000-memory.dmp

Filesize
232KB

Download
memory/2752-20-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download