c1019ece5e1779bda9a8a5a072d9f3806e655a489ddae31fbb4f4eefe57651d3

Submit
Reports

Overview

overview

Static

static

dbbaae6190...18.exe

windows7-x64

dbbaae6190...18.exe

windows10-2004-x64

$PLUGINSDI...sh.dll

windows7-x64

$PLUGINSDI...sh.dll

windows10-2004-x64

$PLUGINSDI...ge.dll

windows7-x64

$PLUGINSDI...ge.dll

windows10-2004-x64

$PLUGINSDI...ns.dll

windows7-x64

$PLUGINSDI...ns.dll

windows10-2004-x64

$PLUGINSDI...LL.dll

windows7-x64

$PLUGINSDI...LL.dll

windows10-2004-x64

$PLUGINSDI...fo.dll

windows7-x64

$PLUGINSDI...fo.dll

windows10-2004-x64

$WINDIR/ls...py.cmd

windows7-x64

$WINDIR/ls...py.cmd

windows10-2004-x64

LingvoSoft...ar.chm

windows7-x64

LingvoSoft...ar.chm

windows10-2004-x64

LingvoSoft...fo.chm

windows7-x64

LingvoSoft...fo.chm

windows10-2004-x64

LingvoSoft...lp.chm

windows7-x64

LingvoSoft...lp.chm

windows10-2004-x64

LingvoSoft...te.url

windows7-x64

LingvoSoft...te.url

windows10-2004-x64

LingvoSoft...ll.exe

windows7-x64

LingvoSoft...ll.exe

windows10-2004-x64

$PLUGINSDI...LL.dll

windows7-x64

$PLUGINSDI...LL.dll

windows10-2004-x64

00lsFRAR.html

windows7-x64

00lsFRAR.html

windows10-2004-x64

LD069D~1.html

windows7-x64

LD069D~1.html

windows10-2004-x64

LD13C4~1.html

windows7-x64

LD13C4~1.html

windows10-2004-x64

Analysis

max time kernel
119s
max time network
125s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 03:28

Sharing

Copy URL

Twitter E-mail

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

dbbaae6190ddcaadd6ec4a95f6a350e5_JaffaCakes118.exe

Resource

win7-20240903-en

discovery

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

dbbaae6190ddcaadd6ec4a95f6a350e5_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/AdvSplash.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/AdvSplash.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/BgImage.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/BgImage.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

$WINDIR/ls-rkf-copy.cmd

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

$WINDIR/ls-rkf-copy.cmd

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Grammar.chm

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Grammar.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LangInfo.chm

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LangInfo.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LingvoSoft Dictionary 2008 Help.chm

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LingvoSoft Dictionary 2008 Help.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Lingvosoft Web Site.url

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Lingvosoft Web Site.url

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Uninstall.exe

Resource

win7-20240903-en

discovery

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral24

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Uninstall.exe

Resource

win10v2004-20240910-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral25

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

00lsFRAR.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

00lsFRAR.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

LD069D~1.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

LD069D~1.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral31

Sample

LD13C4~1.html

Resource

win7-20240729-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

LD13C4~1.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LangInfo.chm
Size

422KB
MD5

6e8849cb5cc38dc261c4eea5f65ea11f
SHA1

aac8869f38055c69fea3e922d8b9ef71fcc39fec
SHA256

0f971db561f4abc852bfe7d93106e168c3809b76ea8da188be1b72d45cea987d
SHA512

88b5ff35deff7451725650ef479ba90ba5ce833925b6fd6fa84a99df332ca4a31a6048bf5db68c97b483fc8b8aabc73544c1c2a63b5159d4b9d1f0c20b835e81
SSDEEP

12288:g8xgjrjWxwZvpPODX53sUq48QnD5F7VuQvU:vGpUX51F8QdLub

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	hh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2764	hh.exe
2764	hh.exe

Processes

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC\LangInfo.chm"
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads