d252b50ee95324217ab4f62d74c0062642799e8be3609165cbaa5e4f8338b769 | Triage

Submit
Reports

Overview

overview

9

Static

static

3

3c350f5d90...18.exe

windows7-x64

7

3c350f5d90...18.exe

windows10-2004-x64

7

InstallTools.exe

windows7-x64

1

InstallTools.exe

windows10-2004-x64

1

bytefence-....7.exe

windows7-x64

4

bytefence-....7.exe

windows10-2004-x64

4

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...gs.dll

windows7-x64

3

$PLUGINSDI...gs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

ByteFence.exe

windows7-x64

9

ByteFence.exe

windows10-2004-x64

7

ByteFenceGUI.dll

windows7-x64

1

ByteFenceGUI.dll

windows10-2004-x64

1

ByteFenceScan.exe

windows7-x64

1

ByteFenceScan.exe

windows10-2004-x64

1

ByteFenceService.exe

windows7-x64

1

ByteFenceService.exe

windows10-2004-x64

1

Microsoft....nt.dll

windows7-x64

1

Microsoft....nt.dll

windows10-2004-x64

1

Microsoft....er.dll

windows7-x64

1

Microsoft....er.dll

windows10-2004-x64

1

amd64/Kern...ol.dll

windows10-2004-x64

1

amd64/msdia140.dll

windows7-x64

7

amd64/msdia140.dll

windows10-2004-x64

7

protobuf-net.dll

windows7-x64

1

protobuf-net.dll

windows10-2004-x64

1

rsEngine.dll

windows7-x64

1

Analysis

max time kernel
133s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
13-05-2024 18:29

Sharing

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

3c350f5d9026b76cba064fb4c136168e_JaffaCakes118.exe

Resource

win7-20240221-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

3c350f5d9026b76cba064fb4c136168e_JaffaCakes118.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

5 signatures

150 seconds

Behavioral task

behavioral3

Sample

InstallTools.exe

Resource

win7-20240508-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

InstallTools.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral5

Sample

bytefence-installer-5.5.0.7.exe

Resource

win7-20240508-en

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral6

Sample

bytefence-installer-5.5.0.7.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/System.dll

Resource

win7-20240220-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/System.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win7-20240221-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/nsDialogs.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/nsExec.dll

Resource

win7-20240419-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/nsExec.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral13

Sample

$PLUGINSDIR/nsisdl.dll

Resource

win7-20240508-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral14

Sample

$PLUGINSDIR/nsisdl.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral15

Sample

ByteFence.exe

Resource

win7-20240221-en

evasion spyware stealer trojan

windows7-x64

19 signatures

150 seconds

Behavioral task

behavioral16

Sample

ByteFence.exe

Resource

win10v2004-20240426-en

evasion spyware stealer trojan

windows10-2004-x64

12 signatures

150 seconds

Behavioral task

behavioral17

Sample

ByteFenceGUI.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

ByteFenceGUI.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

ByteFenceScan.exe

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

ByteFenceScan.exe

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral21

Sample

ByteFenceService.exe

Resource

win7-20240221-en

windows7-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

ByteFenceService.exe

Resource

win10v2004-20240426-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

Microsoft.Diagnostics.Tracing.TraceEvent.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral24

Sample

Microsoft.Diagnostics.Tracing.TraceEvent.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral25

Sample

Microsoft.Win32.TaskScheduler.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral26

Sample

Microsoft.Win32.TaskScheduler.dll

Resource

win10v2004-20240226-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral27

Sample

amd64/KernelTraceControl.dll

Resource

win10v2004-20240426-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

amd64/msdia140.dll

Resource

win7-20231129-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral29

Sample

amd64/msdia140.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral30

Sample

protobuf-net.dll

Resource

win7-20240419-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

protobuf-net.dll

Resource

win10v2004-20240508-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral32

Sample

rsEngine.dll

Resource

win7-20240221-en

windows7-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

amd64/KernelTraceControl.dll
Size

217KB
MD5

23ff4b3eadf12465e19f39b0c19c4361
SHA1

ce0f61dfc428532dc645d2aaed9153d79dbd27d5
SHA256

2005f94acc7c541771066ed98aff6321b911d10c59d2544b853446dbe91f25a5
SHA512

cc618b926c22cabeb2156fe9d82dfa0a181e9bb03e9f1d823f68f656a72fa56fecb92fafbe84ec3712805ec0bd5a903fde6ea33cd05dfc57027800bc516c7538
SSDEEP

3072:nX5gE72vcK8s7pTxEl7Onygi9wDO4z4WSYB0JuPr8AjT//PqLVFUYYBHoC:nXX20y7HNz14RU0J1ALqDUBHoC

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\amd64\KernelTraceControl.dll,#1
1⤵
PID:1544

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2024

Terms | Privacy