Overview
overview
7Static
static
328f80f6493...18.exe
windows7-x64
728f80f6493...18.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
3ffMediaWat...ion.js
windows10-2004-x64
3ff/chrome/...259.js
windows7-x64
3ff/chrome/...259.js
windows10-2004-x64
3ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/MediaWa...59.dll
windows7-x64
6ie/MediaWa...59.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
16s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 02:11
Static task
static1
Behavioral task
behavioral1
Sample
28f80f6493cefa70264896e397281be6_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
28f80f6493cefa70264896e397281be6_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home3259chaction.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home3259chaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home3259.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home3259.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home3259ffaction.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home3259ffaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home3259.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home3259.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/aminsis.dll
-
Size
559KB
-
MD5
51ba1095f0ae45a2d444bea506cb9ad4
-
SHA1
038a5d53d055a6d440bd2c8864c2f51db206c5e5
-
SHA256
b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
-
SHA512
f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
SSDEEP
12288:kbdmSvBuSrDWoN/8Z+iZz2ULoygI/htZw3EKwcxi0T8NGAmN:bSvBuSG7+iZz2ULoyXZzw3E2tT8UAmN
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2540 2536 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2528 wrote to memory of 2536 2528 rundll32.exe 29 PID 2536 wrote to memory of 2540 2536 rundll32.exe 30 PID 2536 wrote to memory of 2540 2536 rundll32.exe 30 PID 2536 wrote to memory of 2540 2536 rundll32.exe 30 PID 2536 wrote to memory of 2540 2536 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\aminsis.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 2203⤵
- Program crash
PID:2540
-
-