Overview
overview
7Static
static
30221350049...18.exe
windows7-x64
70221350049...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3CookComput...V2.dll
windows7-x64
1CookComput...V2.dll
windows10-2004-x64
1Core.dll
windows7-x64
3Core.dll
windows10-2004-x64
3DAL.dll
windows7-x64
3DAL.dll
windows10-2004-x64
3System.Dat...te.dll
windows7-x64
3System.Dat...te.dll
windows10-2004-x64
3ThemeManager.exe
windows7-x64
3ThemeManager.exe
windows10-2004-x64
3UIControls.dll
windows7-x64
3UIControls.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7Analysis
-
max time kernel
95s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
30-09-2024 15:49
Static task
static1
Behavioral task
behavioral1
Sample
0221350049a1b3eee59cd5967f92379c_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0221350049a1b3eee59cd5967f92379c_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
CookComputing.XmlRpcV2.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
CookComputing.XmlRpcV2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
Core.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Core.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
DAL.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
DAL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
System.Data.SQLite.dll
Resource
win7-20240708-en
Behavioral task
behavioral16
Sample
System.Data.SQLite.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
ThemeManager.exe
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
ThemeManager.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
UIControls.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
UIControls.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
General
-
Target
DAL.dll
-
Size
38KB
-
MD5
0c23c94af6eb837b081ec60a3a45bae3
-
SHA1
469089a13c1e36bf54178872c1340710109d2f58
-
SHA256
f3bf66d963d42b741583036e004ca144d19d022a007925f56bfb5c80c4afe5a3
-
SHA512
9f353aa5e8493f8b7afae441909e8c701c50a926a73681e85a10e80c7bcbf995914c7a78b6e638ce945b2391413c4d7082edba755750091a2bfaf8d0ad81a3f7
-
SSDEEP
384:ye/jnG9qxk3g3YUbvwulYZvdiE90JRLZdupJzYsqOleQcbPPOj:nnG90kQokvdUmrDxQQPmj
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4908 3020 rundll32.exe 82 PID 3020 wrote to memory of 4908 3020 rundll32.exe 82 PID 3020 wrote to memory of 4908 3020 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DAL.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\DAL.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4908
-