Overview
overview
8Static
static
3aa54f68350...18.exe
windows7-x64
7aa54f68350...18.exe
windows10-2004-x64
7$PLUGINSDI...er.exe
windows7-x64
7$PLUGINSDI...er.exe
windows10-2004-x64
8$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$SYSDIR/Sk...05.dll
windows7-x64
3$SYSDIR/Sk...05.dll
windows10-2004-x64
3LimeWire A...ol.exe
windows7-x64
3LimeWire A...ol.exe
windows10-2004-x64
3UpdateApp.exe
windows7-x64
3UpdateApp.exe
windows10-2004-x64
3gdiplus.dll
windows7-x64
3gdiplus.dll
windows10-2004-x64
3mfc80.dll
windows7-x64
3mfc80.dll
windows10-2004-x64
3packet.dll
windows7-x64
3packet.dll
windows10-2004-x64
3Analysis
-
max time kernel
135s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
19/08/2024, 08:43
Static task
static1
Behavioral task
behavioral1
Sample
aa54f68350b8a0bac01e02bbe3805ae3_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
aa54f68350b8a0bac01e02bbe3805ae3_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Gossiper.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Gossiper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$SYSDIR/SkinCrafter3_vs2005.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$SYSDIR/SkinCrafter3_vs2005.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
LimeWire Acceleration Tool.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
LimeWire Acceleration Tool.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
UpdateApp.exe
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
UpdateApp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
gdiplus.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
gdiplus.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
mfc80.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
mfc80.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
packet.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
packet.dll
Resource
win10v2004-20240802-en
General
-
Target
packet.dll
-
Size
60KB
-
MD5
c123eb3439ae8ab13a971bb6f0515411
-
SHA1
3ffa02b544b90433e816136e3bbffad0ca19735c
-
SHA256
0b681d867089f44fd9c25a343b94b229b3d9db65d060c6c3767535a31e3eeee4
-
SHA512
99f91d83d43dd73b6737dbbbf4eebf045d9e6a3f2a690210c67f363fa734d1a60b8b306798950668f80762798f52c7c2cfb65260766bbc5aced65ef306fb7aa7
-
SSDEEP
768:ZPwRf6Bph61db4Ws71Ti/kZSC2pZplWsv9Q/OpKX:wZGr71TiYSCa4ilKX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4960 wrote to memory of 5004 4960 rundll32.exe 84 PID 4960 wrote to memory of 5004 4960 rundll32.exe 84 PID 4960 wrote to memory of 5004 4960 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\packet.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\packet.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:5004
-