Overview
overview
7Static
static
3d2fae0d5d8...18.exe
windows7-x64
7d2fae0d5d8...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3BASS.dll
windows7-x64
3BASS.dll
windows10-2004-x64
3MagicInlay.exe
windows7-x64
3MagicInlay.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3aminstall.dll
windows7-x64
3aminstall.dll
windows10-2004-x64
3eula.rtf
windows7-x64
4eula.rtf
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 22:38
Static task
static1
Behavioral task
behavioral1
Sample
d2fae0d5d89d46506bf9fc63e2089fdb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2fae0d5d89d46506bf9fc63e2089fdb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
BASS.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
BASS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
MagicInlay.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
MagicInlay.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
Uninstall.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
aminstall.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
aminstall.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
eula.rtf
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
eula.rtf
Resource
win10v2004-20240802-en
General
-
Target
MagicInlay.exe
-
Size
1.6MB
-
MD5
4f7a8a5a64dcd62d328fbc2708b5d8fa
-
SHA1
86f60c6d0dc9468143a22e1a7cee05dc92ab7b88
-
SHA256
65fba649a99baa931d358cb363bb1a6004d9a7c2c8127250c2794d3666f7e2a2
-
SHA512
ae376111bf453c7f07377ef18d2f5bc41c1225946b9e7ce2e58e42764d5833969c7ac45a41f11cc32a4f630f4bb6cc924ffdbba8183d8347d778272c422587b4
-
SSDEEP
49152:rDDXwfoPGU5lvsJluDwZAoA0f94g57hinKWTy:DXYoPD5lUNB4ihC9Ty
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MagicInlay.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch MagicInlay.exe Set value (str) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" MagicInlay.exe Key created \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Software\Microsoft\Internet Explorer\IESettingSync MagicInlay.exe Set value (int) \REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" MagicInlay.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe 4928 MagicInlay.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4928 MagicInlay.exe 4928 MagicInlay.exe