Overview
overview
7Static
static
3bc0c44357c...18.exe
windows7-x64
7bc0c44357c...18.exe
windows10-2004-x64
7$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PROGRAMFI...R1.dll
windows7-x64
6$PROGRAMFI...R1.dll
windows10-2004-x64
6Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 14:08
Static task
static1
Behavioral task
behavioral1
Sample
bc0c44357c2dd5683406f6523f65590e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc0c44357c2dd5683406f6523f65590e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PROGRAMFILES/Mozilla Firefox/$R1.dll
Resource
win7-20240705-en
General
-
Target
$PLUGINSDIR/UAC.dll
-
Size
17KB
-
MD5
88ad3fd90fc52ac3ee0441a38400a384
-
SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b
-
SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42
-
SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb
-
SSDEEP
384:59TzaeW+WyB8c7LX+OGkrwWvVrkUiEMAWm5nskAvXkq:5ZaB+W62Mr5vGUiEum5sk
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1720 2588 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2572 wrote to memory of 2588 2572 rundll32.exe 30 PID 2588 wrote to memory of 1720 2588 rundll32.exe 31 PID 2588 wrote to memory of 1720 2588 rundll32.exe 31 PID 2588 wrote to memory of 1720 2588 rundll32.exe 31 PID 2588 wrote to memory of 1720 2588 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\UAC.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2588 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2588 -s 2243⤵
- Program crash
PID:1720
-
-