Overview
overview
7Static
static
705ec76c031...18.exe
windows7-x64
305ec76c031...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3CnCalendar.dll
windows7-x64
3CnCalendar.dll
windows10-2004-x64
3Memo.exe
windows7-x64
6Memo.exe
windows10-2004-x64
6SqliteDB.dll
windows7-x64
3SqliteDB.dll
windows10-2004-x64
3eAPI.dll
windows7-x64
3eAPI.dll
windows10-2004-x64
3eGrid.dll
windows7-x64
3eGrid.dll
windows10-2004-x64
3iext.dll
windows7-x64
3iext.dll
windows10-2004-x64
3iext5.dll
windows7-x64
3iext5.dll
windows10-2004-x64
3krnln.dll
windows7-x64
3krnln.dll
windows10-2004-x64
3shell.dll
windows7-x64
3shell.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 13:04
Behavioral task
behavioral1
Sample
05ec76c0318e9f49e74ff3e3accb76bb_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
05ec76c0318e9f49e74ff3e3accb76bb_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
CnCalendar.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
CnCalendar.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
Memo.exe
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
Memo.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
SqliteDB.dll
Resource
win7-20240729-en
Behavioral task
behavioral10
Sample
SqliteDB.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
eAPI.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
eAPI.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
eGrid.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
eGrid.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
iext.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
iext.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
iext5.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
iext5.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
krnln.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
krnln.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
shell.dll
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
shell.dll
Resource
win10v2004-20240802-en
General
-
Target
shell.dll
-
Size
56KB
-
MD5
d503caef345c868583c7895821438573
-
SHA1
80671756081eed46a8aed74f3a076bf5c4fcdb7d
-
SHA256
510ac1b1ea5bcc3fd42d3a5df47ec43e7453e1b1b958c1baa14bdb10243eebb3
-
SHA512
9309757d67a19e3ceebe5eadbdccc9ec1baaa29a2c6b5243f1442169b170fc9170aff1f38267c76def2622c6da73ae7b2fdb5a7912596e0637a060a09f65bbee
-
SSDEEP
768:utxVWT/F9Te6mQoqvAqBAdVwhVGFj9oWIqF6J3W:utxUN9TeFZdGLG7oWIqY3W
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30 PID 3028 wrote to memory of 1128 3028 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\shell.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\shell.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:1128
-