Overview
overview
7Static
static
7bb62760293...18.exe
windows7-x64
7bb62760293...18.exe
windows10-2004-x64
$PLUGINSDI...ol.dll
windows7-x64
3$PLUGINSDI...ol.dll
windows10-2004-x64
3$PLUGINSDI...FC.dll
windows7-x64
3$PLUGINSDI...FC.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
7$PLUGINSDI...ll.dll
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3EasyDL.exe
windows7-x64
7EasyDL.exe
windows10-2004-x64
7EasyDownloads.exe
windows7-x64
7EasyDownloads.exe
windows10-2004-x64
7current-cloud.html
windows7-x64
3current-cloud.html
windows10-2004-x64
3htmlayout.dll
windows7-x64
7htmlayout.dll
windows10-2004-x64
7Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 10:37
Behavioral task
behavioral1
Sample
bb627602934a526d02345485f85de3aa_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
bb627602934a526d02345485f85de3aa_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win7-20240705-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AccessControl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/SimpleFC.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/SimpleFC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/md5dll.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/md5dll.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
EasyDL.exe
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
EasyDL.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
EasyDownloads.exe
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
EasyDownloads.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
current-cloud.html
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
current-cloud.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
htmlayout.dll
Resource
win7-20240705-en
General
-
Target
EasyDL.exe
-
Size
1.4MB
-
MD5
cab474650ccde81bdb109be6ffc680ea
-
SHA1
d8eb6b58ad0e1495285fea183515868773d9cbb7
-
SHA256
70aca20647c65107dffcee4e346f6cb049d9a9305b95db8f702adc5476499708
-
SHA512
b24b1983b3ca5fbcdaa3a50b403f90c3d2490a815e72a215e3d28e3b6ba820a6f443c36e36fb8017314b4ffe5b549dccadd108c22c82cd68fa2babf3e22e3810
-
SSDEEP
24576:4/dRywz9R14OxNOtqeb1pRcUN6ptAaqgPjN7QFeSY/8SUYDd5zFsOTtIkG:ulz99iRb1ABptIeN/8S1DzF9I
Malware Config
Signatures
-
resource yara_rule behavioral13/memory/2972-1-0x0000000010000000-0x000000001025E000-memory.dmp upx behavioral13/memory/2972-5-0x0000000010000000-0x000000001025E000-memory.dmp upx -
resource yara_rule behavioral13/memory/2972-0-0x0000000000400000-0x00000000007DE000-memory.dmp vmprotect behavioral13/memory/2972-2-0x0000000000400000-0x00000000007DE000-memory.dmp vmprotect behavioral13/memory/2972-6-0x0000000000400000-0x00000000007DE000-memory.dmp vmprotect -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EasyDL.exe