Overview
overview
7Static
static
5JaffaCakes...65.exe
windows7-x64
7JaffaCakes...65.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
7$PLUGINSDI...le.exe
windows10-2004-x64
7$PLUGINSDI...t.html
windows7-x64
3$PLUGINSDI...t.html
windows10-2004-x64
3$PLUGINSDI...90.dll
windows7-x64
3$PLUGINSDI...90.dll
windows10-2004-x64
3$PLUGINSDI...90.dll
windows7-x64
3$PLUGINSDI...90.dll
windows10-2004-x64
3$PLUGINSDI...90.dll
windows7-x64
3$PLUGINSDI...90.dll
windows10-2004-x64
3$PLUGINSDIR/tools.dll
windows7-x64
3$PLUGINSDIR/tools.dll
windows10-2004-x64
3$PLUGINSDI...er.exe
windows7-x64
3$PLUGINSDI...er.exe
windows10-2004-x64
3FileHunter.exe
windows7-x64
5FileHunter.exe
windows10-2004-x64
5uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7updater.exe
windows7-x64
3updater.exe
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 22:08
Behavioral task
behavioral1
Sample
JaffaCakes118_6327c5a3030d6c2fddf0bcdef01daf65.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_6327c5a3030d6c2fddf0bcdef01daf65.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/layout.html
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/layout.html
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/msvcm90.dll
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/msvcm90.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/msvcp90.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/msvcp90.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/msvcr90.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/msvcr90.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/tools.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/tools.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/updater.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/updater.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
FileHunter.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
FileHunter.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
uninstall.exe
Resource
win7-20240708-en
Behavioral task
behavioral26
Sample
uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
updater.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
updater.exe
Resource
win10v2004-20241007-en
General
-
Target
FileHunter.exe
-
Size
1.1MB
-
MD5
42a2254574d663e3cf53f1c26d7edc12
-
SHA1
5dd5b7707a1eab91f5d2b15f37da02dea9b1aa58
-
SHA256
0a7844f24d0fc8cb8f6d680bb7a268f912d773e9152397607431ff1275e8dce6
-
SHA512
f901a32e745912ae54d257093e564eeefd64c7a62f157e3a36cb079a1a3d24d791b638aad369db15ba4b62e8741c09f8d77080ed506902b764064d296debae33
-
SSDEEP
12288:NDdMFeHj30zq3/w64X3K4Aa4JFe+bm1tiGz7kUo1Ax0Ee5P721oBAaoPR1wHQPAo:6O3O3Kda4u+KvZsR1ACEe5D2SBfMHFT
Malware Config
Signatures
-
resource yara_rule behavioral23/memory/3016-0-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-2-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-3-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-5-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-6-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-7-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-8-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-9-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-10-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-11-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-12-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-13-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-14-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-15-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-16-0x0000000000400000-0x00000000006C2000-memory.dmp upx behavioral23/memory/3016-17-0x0000000000400000-0x00000000006C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FileHunter.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe 3016 FileHunter.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3016 FileHunter.exe 3016 FileHunter.exe