Overview
overview
7Static
static
33d086bd6f3...18.exe
windows7-x64
73d086bd6f3...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-10-2024 01:19
Static task
static1
Behavioral task
behavioral1
Sample
3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3d086bd6f3e40105c550a13f0de8b1bc_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/Banner.dll
-
Size
4KB
-
MD5
0116a50101c4107a138a588d1e46fca5
-
SHA1
b781dce23e828cf2b97306661c7dad250a6aaf77
-
SHA256
ab80cf45070d936f0745f5e39b22e6e07ba90aa179b5ec4469ef6e2cb1b9ef6b
-
SHA512
55de6aeaad05b01a25828553d3ea9f1b32a8b0c35c42dc6106bed244320e3421ec6a6f5359b15f9d18dd1e9692ca5572b2736d9d48cceb07b9443601d00a5988
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30 PID 2148 wrote to memory of 2020 2148 rundll32.exe 30
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\Banner.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:2020
-