Overview
overview
3Static
static
3c12f1d5ff5...18.exe
windows7-x64
3c12f1d5ff5...18.exe
windows10-2004-x64
3$PLUGINSDIR/Guard.dll
windows7-x64
3$PLUGINSDIR/Guard.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...st.dll
windows7-x64
3$PLUGINSDI...st.dll
windows10-2004-x64
3Analysis
-
max time kernel
139s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-08-2024 17:01
Static task
static1
Behavioral task
behavioral1
Sample
c12f1d5ff5b0da807a3ddfedc94c1cd6_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
c12f1d5ff5b0da807a3ddfedc94c1cd6_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Guard.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Guard.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/Uninst.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/Uninst.dll
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/Uninst.dll
-
Size
5KB
-
MD5
c14995f7e5e62d018e292aad7ee42d80
-
SHA1
0ea12c120b4677e472e080d99ce1d1aedf73e760
-
SHA256
d8199fb93159f691dabe83e09e605694d6761a6781bd3e7d0c09c12ccb13e73f
-
SHA512
496fe661754f609250a5eb401f241e0cfb9a59d8aab6c880b66160a2b8cb88e851d12ea2d2eb62a621b90c375979744ef70075f895098d40afbe418301e8a8e4
-
SSDEEP
48:SOH2Ud57bUUNJUqv9o03MdXIu36etjmdcB7IZiNFuvYSC5731XM8DQqnm1VAwQoG:lxUe9o+MZIE6eJmeGZsoA31lMUSVgS
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 448 wrote to memory of 1580 448 rundll32.exe 83 PID 448 wrote to memory of 1580 448 rundll32.exe 83 PID 448 wrote to memory of 1580 448 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Uninst.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Uninst.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1580
-