Overview
overview
8Static
static
32c98b86dfd...18.exe
windows7-x64
82c98b86dfd...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
3$PLUGINSDI...mp.exe
windows7-x64
1$PLUGINSDI...mp.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.exe
windows7-x64
3$PLUGINSDI...er.exe
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDIR/xml.dll
windows7-x64
3$PLUGINSDIR/xml.dll
windows10-2004-x64
3$PROGRAMFI...st.exe
windows7-x64
7$PROGRAMFI...st.exe
windows10-2004-x64
7$PLUGINSDI...md.dll
windows7-x64
3$PLUGINSDI...md.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3General
-
Target
2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118
-
Size
23.2MB
-
Sample
241009-hezdzatcld
-
MD5
2c98b86dfd5ba8f1d2e38f00370ad4b9
-
SHA1
19144bc217ca11f092e5f4bfd187cea7586172b2
-
SHA256
1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75
-
SHA512
502870a5629ceaacaa0a87d8dca62e7d810b0e2ea1e210e797a589c7ca3c79acf31822677110de61fe5fd2096a08511c305bd151a5373825de73a3e7ebb63eaa
-
SSDEEP
393216:gt0l6b0pNXBGox+LEAW8FGivNLV3XrRHY8pqbqUkpdQ70+Gdg1uu:gt0cbMX7x9AXhVZnN48pfzpdfrd8
Static task
static1
Behavioral task
behavioral1
Sample
2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/JpgToBmp.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/JpgToBmp.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/UXTheme Patcher.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/UXTheme Patcher.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/xml.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/xml.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/Angry Birds Space Skin Pack/$PROGRAMFILES/Angry Birds Space Skin Pack/uninst.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/Angry Birds Space Skin Pack/$PROGRAMFILES/Angry Birds Space Skin Pack/uninst.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/ExecCmd.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
2c98b86dfd5ba8f1d2e38f00370ad4b9_JaffaCakes118
-
Size
23.2MB
-
MD5
2c98b86dfd5ba8f1d2e38f00370ad4b9
-
SHA1
19144bc217ca11f092e5f4bfd187cea7586172b2
-
SHA256
1b491752f18b866c048ebd243a4ef8a68d358c7d23b228705d06b1d9f612da75
-
SHA512
502870a5629ceaacaa0a87d8dca62e7d810b0e2ea1e210e797a589c7ca3c79acf31822677110de61fe5fd2096a08511c305bd151a5373825de73a3e7ebb63eaa
-
SSDEEP
393216:gt0l6b0pNXBGox+LEAW8FGivNLV3XrRHY8pqbqUkpdQ70+Gdg1uu:gt0cbMX7x9AXhVZnN48pfzpdfrd8
Score8/10-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-
Sets desktop wallpaper using registry
-
-
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
0116a50101c4107a138a588d1e46fca5
-
SHA1
b781dce23e828cf2b97306661c7dad250a6aaf77
-
SHA256
ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
-
SHA512
55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Score3/10 -
-
-
Target
$PLUGINSDIR/ExecCmd.dll
-
Size
4KB
-
MD5
b1d08c24cad3f8f6ccd6b9ebd24d30c0
-
SHA1
d01549db25d0345c05d3c2eb90b173f937966ce5
-
SHA256
c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
-
SHA512
9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8
Score3/10 -
-
-
Target
$PLUGINSDIR/JpgToBmp.exe
-
Size
44KB
-
MD5
a3e8696c93ad86d6b76a455e9d04582f
-
SHA1
17368dc01a16b6a67663c1900575aa96f5e170ba
-
SHA256
cce22a24171bca94741e8e5aed408b8abf33f20a27c6fe8696947285e7e7da70
-
SHA512
85de5fcdc530c787aae8aa9ef3a0c27f22ac65dd8ca066e71859b417d141cf49d4013fc05b008cd49dad66a90f23efcd8bd37bc7360c6873171e334cbb7ce30c
-
SSDEEP
768:VZmjJPk428s6nJrvfB/yLtpMUnN3aml6:VS3JDfsRdNHl6
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score3/10 -
-
-
Target
$PLUGINSDIR/UXTheme Patcher.exe
-
Size
72KB
-
MD5
c35efaa15f6f1da888efc247e886389d
-
SHA1
e3f35519380a564ff62f5ea2fa95fd5bca38bb1a
-
SHA256
558f6e38c300957234231234c44ccf41217182677e859c9005a51094bdf01794
-
SHA512
fd3d27271cab60f51929a4e92cccd0ce2edf8c95fd2db6cc957620ff2f7522e644b67862ec7803e6068f5ae75caedad9daae3dafdd4b7f4898c618c8498dca16
-
SSDEEP
1536:oI78vwnEmMpryYRt2M5d3YieAB3iW+IalC6L9XMI+l1+hX:/78vwnEm+1RAkd3deANZ+IoC6xXMIYg1
Score3/10 -
-
-
Target
$PLUGINSDIR/inetc.dll
-
Size
20KB
-
MD5
f02155fa3e59a8fc48a74a236b2bb42e
-
SHA1
6d76ee8f86fb29f3352c9546250d940f1a476fb8
-
SHA256
096a4dc5150f631b4d4d10cae07ef0974dda205b174399f46209265e89c2c999
-
SHA512
8be78e88c5ef2cd01713f7b5154cfdeea65605cc5d110522375884eeec6bad68616a4058356726cbbd15d28b42914864045f0587e1e49a4e18336f06c1c73399
-
SSDEEP
384:voJLJVqG5WLJgu/Emx1Ywxd2ZmX66vwUhU7ya4LC0Ac9khYLMkIX0+Gv8gcLom7:AJVkN8mHYwxdWmX3wUhUua4LeT7
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
c10e04dd4ad4277d5adc951bb331c777
-
SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
-
SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
-
SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
SSDEEP
96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
acc2b699edfea5bf5aae45aba3a41e96
-
SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2
-
SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
-
SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
SSDEEP
96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score3/10 -
-
-
Target
$PLUGINSDIR/xml.dll
-
Size
118KB
-
MD5
42df1fbaa87567adf2b4050805a1a545
-
SHA1
b892a6efbb39b7144248e0c0d79e53da474a9373
-
SHA256
e900fcb9d598643eb0ee3e4005da925e73e70dbaa010edc4473e99ea0638b845
-
SHA512
4537d408e2f54d07b018907c787da6c7340f909a1789416de33d090055eda8918f338d8571bc3b438dd89e5e03e0ded70c86702666f12adb98523a91cbb1de1d
-
SSDEEP
1536:U2A8OSGjylgkara+70LICin9zgtg2LxowhtJu6MqSNicNEtIfF42q2KC:OzjLkarn7O+n9z2L6whFtGF42bK
Score3/10 -
-
-
Target
$PROGRAMFILES/Angry Birds Space Skin Pack/$PROGRAMFILES/Angry Birds Space Skin Pack/uninst.exe
-
Size
464KB
-
MD5
12341788cbeea061df74e281e568ebde
-
SHA1
421f17a4a59eede1263bb749ba5a67b43cb4fba7
-
SHA256
3a0cd378658b6ca19c95025805dabc4072f83917bc66647981aefbc872c25737
-
SHA512
197ee1f1fcccd00eead1f15b2b7fcd1080af2d0c47e42345d03f27a3530809cfd5813ba96ef9269501c847e0b92d687cbada312dd911bac722cc5928095910ba
-
SSDEEP
12288:o4KBAG8S3ffvzMU1i9xtQlN0WGTKnkGx7YCJ2GC:oleG8S3oKdMWGObYA2GC
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
$PLUGINSDIR/ExecCmd.dll
-
Size
4KB
-
MD5
b1d08c24cad3f8f6ccd6b9ebd24d30c0
-
SHA1
d01549db25d0345c05d3c2eb90b173f937966ce5
-
SHA256
c4b6ff0091b3401670c8c6d3cb337d3ba0c2a514e66b0ea3501bb7ef78ddba69
-
SHA512
9cb5735c86cdf8d126268b7b2ec8fafd654d69bdfe5336d54b7d44b5ac8e1174836c487bb4aa40517516a55323bf9f916a96753c8dd2bc9b2d481071c9d9fbf8
Score3/10 -
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
c17103ae9072a06da581dec998343fc1
-
SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
-
SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
-
SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
SSDEEP
192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
c10e04dd4ad4277d5adc951bb331c777
-
SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
-
SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
-
SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
-
SSDEEP
96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
acc2b699edfea5bf5aae45aba3a41e96
-
SHA1
d2accf4d494e43ceb2cff69abe4dd17147d29cc2
-
SHA256
168a974eaa3f588d759db3f47c1a9fdc3494ba1fa1a73a84e5e3b2a4d58abd7e
-
SHA512
e29ea10ada98c71a18273b04f44f385b120d4e8473e441ce5748cfa44a23648814f2656f429b85440157988c88de776c6ac008dc38bf09cbb746c230a46c69fe
-
SSDEEP
96:M7GUb+YNfwgcr8zyKwZ5S4JxN8BS0ef9/3VI9d0qqyVgNk32E:eKgfwgcr8zylsB49Ud0qJVgNX
Score3/10 -
-
-
Target
$PLUGINSDIR/registry.dll
-
Size
16KB
-
MD5
1c9523d1c77e5c18d7f1cf3be21c9392
-
SHA1
f6afd13a7e0585082f64600959c3b31d18e55946
-
SHA256
d1bd1879f4c1e9a7c3233ba79eb44c93fecb4d3ecdad7b896e4e2e1b14690459
-
SHA512
52662a37ed0ec9db7a94c245488bf3639e7d2dd76ec28b08415ee93b53489bdf7fc38c1df768033a6a2a2a2571709518e81d66a325f6609d6552442a1aef4c4b
-
SSDEEP
384:Gw418n2r8Qt89Bo/VLkSgPXmSicwocAnazI:F4pF8A/l2WSicwJz
Score3/10 -