Overview
overview
7Static
static
38a8c1f154e...18.exe
windows7-x64
78a8c1f154e...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
317fh3inryg...fhh.js
windows7-x64
317fh3inryg...fhh.js
windows10-2004-x64
3clicktale.js
windows7-x64
3clicktale.js
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
clicktale.js
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
clicktale.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
f8d9d9418e6e1827ed2b53dd930e48fb
-
SHA1
c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
-
SHA256
2a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
-
SHA512
510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
-
SSDEEP
192:eMGGr8JZYGO9QQr5aQbf1QuQVOmDsjcdOISYKoTs11929WtshLAzuy:eMGu8Jy1ai5aZBptdYYKCs/Yos
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4048 4424 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 5004 wrote to memory of 4424 5004 rundll32.exe 84 PID 5004 wrote to memory of 4424 5004 rundll32.exe 84 PID 5004 wrote to memory of 4424 5004 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4424 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 6363⤵
- Program crash
PID:4048
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4424 -ip 44241⤵PID:952