Overview
overview
3Static
static
373d544d095...18.exe
windows7-x64
373d544d095...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...et.dll
windows7-x64
3$PLUGINSDI...et.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3repair.exe
windows7-x64
repair.exe
windows10-2004-x64
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
26/07/2024, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
73d544d095ae9a9a7b26ae376745d73c_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
73d544d095ae9a9a7b26ae376745d73c_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Internet.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Internet.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240704-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
repair.exe
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
repair.exe
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
952ce5aeeab2b77728a9fd9cb38d2d74
-
SHA1
0cb1b936dddab231f789813789027965cc46fcfc
-
SHA256
f1c245f152db080cce5a0c8c4ab1c9727721d2f69e22a56955647db9332a3cdc
-
SHA512
598a243ad7148f08501da05c5e3e4b9ead817c613bd539c350f84042e2b7a37fa5b24697ca27d474c68b4715a3274f208369f182b70b844f59b3b5f16f5ed36c
-
SSDEEP
96:Z+yBC0x22epxPEvC4FkWE+in1/FMvsCGRfRFqCB5tkGhEl5VN:Z+6epxPE1r8/FtmCDtbg5v
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 3472 700 WerFault.exe 85 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3232 wrote to memory of 700 3232 rundll32.exe 85 PID 3232 wrote to memory of 700 3232 rundll32.exe 85 PID 3232 wrote to memory of 700 3232 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:700 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 700 -s 6123⤵
- Program crash
PID:3472
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 700 -ip 7001⤵PID:4700