Overview
overview
7Static
static
7eaab7858ee...18.exe
windows7-x64
7eaab7858ee...18.exe
windows10-2004-x64
7$PLUGINSDI...if.dll
windows7-x64
3$PLUGINSDI...if.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...ig.dll
windows7-x64
3$PLUGINSDI...ig.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...tc.dll
windows7-x64
3$PLUGINSDI...tc.dll
windows10-2004-x64
3$PLUGINSDI...eb.dll
windows7-x64
3$PLUGINSDI...eb.dll
windows10-2004-x64
3$PLUGINSDI...rs.dll
windows7-x64
3$PLUGINSDI...rs.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...ay.dll
windows7-x64
7$PLUGINSDI...ay.dll
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
7$PLUGINSDI...on.dll
windows10-2004-x64
7$TEMP/free...xt.rtf
windows7-x64
4$TEMP/free...xt.rtf
windows10-2004-x64
1Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19-09-2024 05:27
Behavioral task
behavioral1
Sample
eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eaab7858ee68fef371d269c5f29ac42e_JaffaCakes118.exe
Resource
win10v2004-20240910-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/AnimGif.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win7-20240729-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BgWorker.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/ExecDos.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/IpConfig.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/TkInetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/TkInetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/TkNsweb.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/TkNsweb.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/ToolkitOffers.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/ToolkitOffers.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/version.dll
Resource
win7-20240729-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/version.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$TEMP/freetwittube_text.rtf
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$TEMP/freetwittube_text.rtf
Resource
win10v2004-20240802-en
General
-
Target
$PLUGINSDIR/TkInetc.dll
-
Size
172KB
-
MD5
8777f46e35ab035d4b526377d9a7097b
-
SHA1
9780ff9145be4aa7a912e6dbaaf7d781316b9adb
-
SHA256
d5bb2ebaac75a1588f00cea3d35faea0e5a3c7c319785406315cda2d4a52bb47
-
SHA512
131d6d9de492d55dc55df396a5153119bcb1c09c723abf009d8a7ef3cc71244b51f7ac1715bf7bc23c9b94ac661c255cd7a30e97267295ce060487705395128c
-
SSDEEP
3072:bhW2YXDpNYCy32SHyE1k7skVSiIJz6Kp+CYF:bhW2YTIJzk7skVXIg
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2944 2168 WerFault.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 868 wrote to memory of 2168 868 rundll32.exe 31 PID 2168 wrote to memory of 2944 2168 rundll32.exe 32 PID 2168 wrote to memory of 2944 2168 rundll32.exe 32 PID 2168 wrote to memory of 2944 2168 rundll32.exe 32 PID 2168 wrote to memory of 2944 2168 rundll32.exe 32
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkInetc.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\TkInetc.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 2323⤵
- Program crash
PID:2944
-
-