c1019ece5e1779bda9a8a5a072d9f3806e655a489ddae31fbb4f4eefe57651d3

Submit
Reports

Overview

overview

Static

static

dbbaae6190...18.exe

windows7-x64

dbbaae6190...18.exe

windows10-2004-x64

$PLUGINSDI...sh.dll

windows7-x64

$PLUGINSDI...sh.dll

windows10-2004-x64

$PLUGINSDI...ge.dll

windows7-x64

$PLUGINSDI...ge.dll

windows10-2004-x64

$PLUGINSDI...ns.dll

windows7-x64

$PLUGINSDI...ns.dll

windows10-2004-x64

$PLUGINSDI...LL.dll

windows7-x64

$PLUGINSDI...LL.dll

windows10-2004-x64

$PLUGINSDI...fo.dll

windows7-x64

$PLUGINSDI...fo.dll

windows10-2004-x64

$WINDIR/ls...py.cmd

windows7-x64

$WINDIR/ls...py.cmd

windows10-2004-x64

LingvoSoft...ar.chm

windows7-x64

LingvoSoft...ar.chm

windows10-2004-x64

LingvoSoft...fo.chm

windows7-x64

LingvoSoft...fo.chm

windows10-2004-x64

LingvoSoft...lp.chm

windows7-x64

LingvoSoft...lp.chm

windows10-2004-x64

LingvoSoft...te.url

windows7-x64

LingvoSoft...te.url

windows10-2004-x64

LingvoSoft...ll.exe

windows7-x64

LingvoSoft...ll.exe

windows10-2004-x64

$PLUGINSDI...LL.dll

windows7-x64

$PLUGINSDI...LL.dll

windows10-2004-x64

00lsFRAR.html

windows7-x64

00lsFRAR.html

windows10-2004-x64

LD069D~1.html

windows7-x64

LD069D~1.html

windows10-2004-x64

LD13C4~1.html

windows7-x64

LD13C4~1.html

windows10-2004-x64

Analysis

max time kernel
92s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-09-2024 03:28

Sharing

Copy URL

Twitter E-mail

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

dbbaae6190ddcaadd6ec4a95f6a350e5_JaffaCakes118.exe

Resource

win7-20240903-en

discovery

windows7-x64

4 signatures

150 seconds

Behavioral task

behavioral2

Sample

dbbaae6190ddcaadd6ec4a95f6a350e5_JaffaCakes118.exe

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral3

Sample

$PLUGINSDIR/AdvSplash.dll

Resource

win7-20240708-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral4

Sample

$PLUGINSDIR/AdvSplash.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral5

Sample

$PLUGINSDIR/BgImage.dll

Resource

win7-20240903-en

discovery

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral6

Sample

$PLUGINSDIR/BgImage.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

2 signatures

150 seconds

Behavioral task

behavioral7

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral8

Sample

$PLUGINSDIR/InstallOptions.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral9

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral10

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral11

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral12

Sample

$PLUGINSDIR/UserInfo.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral13

Sample

$WINDIR/ls-rkf-copy.cmd

Resource

win7-20240903-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

$WINDIR/ls-rkf-copy.cmd

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Grammar.chm

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral16

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Grammar.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral17

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LangInfo.chm

Resource

win7-20240903-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral18

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LangInfo.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LingvoSoft Dictionary 2008 Help.chm

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral20

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LingvoSoft Dictionary 2008 Help.chm

Resource

win10v2004-20240802-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Lingvosoft Web Site.url

Resource

win7-20240704-en

windows7-x64

0 signatures

150 seconds

Behavioral task

behavioral22

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Lingvosoft Web Site.url

Resource

win10v2004-20240802-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral23

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Uninstall.exe

Resource

win7-20240903-en

discovery

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral24

Sample

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/Uninstall.exe

Resource

win10v2004-20240910-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral25

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win7-20240903-en

discovery

windows7-x64

3 signatures

150 seconds

Behavioral task

behavioral26

Sample

$PLUGINSDIR/LangDLL.dll

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

3 signatures

150 seconds

Behavioral task

behavioral27

Sample

00lsFRAR.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral28

Sample

00lsFRAR.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral29

Sample

LD069D~1.html

Resource

win7-20240903-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral30

Sample

LD069D~1.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Behavioral task

behavioral31

Sample

LD13C4~1.html

Resource

win7-20240729-en

discovery

windows7-x64

5 signatures

150 seconds

Behavioral task

behavioral32

Sample

LD13C4~1.html

Resource

win10v2004-20240802-en

discovery

windows10-2004-x64

7 signatures

150 seconds

Report Analysis Logs

General

Target

LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC/LingvoSoft Dictionary 2008 Help.chm
Size

327KB
MD5

160a97272bd2e78d91ba800280bb5a8f
SHA1

8d7a13ef781dcf403bc4b5d364858405104026a1
SHA256

98568e7068b06876f914d3e5d3a21e2282113e8d62aa5f9a2fbb935f02d8bbf3
SHA512

4731d1c59dfc8e90db6d7a6814515bdbd9511c65e2d9963e0974e1930261e3b2f4aa890c835301d442df53b0db6359909e1bf4200c5c87271cfef596afe67b6b
SSDEEP

6144:hSt6PDPMLy6c6OvhkzTmLQKEqDAmHqs0mxA8QXNMfCPZfqN6jXUZuj0XMaNI0Xyf:Mt6556ihcKEMTHqexAmjWXULv3Xyf

Score

1^/10

Malware Config

Signatures

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4052	hh.exe
4052	hh.exe

Processes

C:\Windows\hh.exe
"C:\Windows\hh.exe" "C:\Users\Admin\AppData\Local\Temp\LingvoSoft Dictionary 2008 (French-Arabic) for Pocket PC\LingvoSoft Dictionary 2008 Help.chm"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4052

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads