Overview
overview
7Static
static
38a8c1f154e...18.exe
windows7-x64
78a8c1f154e...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
317fh3inryg...fhh.js
windows7-x64
317fh3inryg...fhh.js
windows10-2004-x64
3clicktale.js
windows7-x64
3clicktale.js
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
clicktale.js
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
clicktale.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
3e6bf00b3ac976122f982ae2aadb1c51
-
SHA1
caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
-
SHA256
4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
-
SHA512
1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
SSDEEP
192:eP24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlbSl:T8QIl975eXqlWBrz7YLOlb
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2676 2892 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2736 wrote to memory of 2892 2736 rundll32.exe 30 PID 2892 wrote to memory of 2676 2892 rundll32.exe 31 PID 2892 wrote to memory of 2676 2892 rundll32.exe 31 PID 2892 wrote to memory of 2676 2892 rundll32.exe 31 PID 2892 wrote to memory of 2676 2892 rundll32.exe 31
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2892 -s 2243⤵
- Program crash
PID:2676
-
-