Overview
overview
7Static
static
73ccc3e661c...18.exe
windows7-x64
73ccc3e661c...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Mame32.chm
windows7-x64
1Mame32.chm
windows10-2004-x64
1kailleraclient.dll
windows7-x64
7kailleraclient.dll
windows10-2004-x64
7mame32k.exe
windows7-x64
7mame32k.exe
windows10-2004-x64
7mame32kk.exe
windows7-x64
1mame32kk.exe
windows10-2004-x64
1zip32.dll
windows7-x64
3zip32.dll
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 09:19
Behavioral task
behavioral1
Sample
3ccc3e661c87c5207bfecc89e6c6cc98_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3ccc3e661c87c5207bfecc89e6c6cc98_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
Mame32.chm
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
Mame32.chm
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
kailleraclient.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
kailleraclient.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
mame32k.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
mame32k.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
mame32kk.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
mame32kk.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
zip32.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
zip32.dll
Resource
win10v2004-20240709-en
General
-
Target
mame32k.exe
-
Size
3.4MB
-
MD5
635f4bedc82b1f90e40919130685e972
-
SHA1
4e966f3dd0a3f4018f0af3e936deab90df6b9e70
-
SHA256
bc3195c50eac0cbf4591bea14aa5666b7ec71c7a0c3185a4dd3a77608442726a
-
SHA512
8f47d846afeffe4b0221ba9228588fbda11051040526c2194e313763b1ce9499443f80e223759e39ffcd8c36cffbacc82d7da5a73cf75e9e108102ce3b7f240a
-
SSDEEP
49152:JYjAmLixk+br/lLH6CHBXB5tus9x2gLoMRRcU8SsdU6un+vQIas3uG0KbN:JY1ck+f9zTBxjnL2JU8e6pQM3N
Malware Config
Signatures
-
resource yara_rule behavioral10/memory/3620-0-0x0000000000400000-0x0000000001701000-memory.dmp upx behavioral10/memory/3620-1-0x0000000010000000-0x0000000010017000-memory.dmp upx behavioral10/memory/3620-2-0x0000000000400000-0x0000000001701000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3620 mame32k.exe