Overview
overview
7Static
static
7JaffaCakes...09.exe
windows7-x64
7JaffaCakes...09.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
5$PLUGINSDI...oc.dll
windows10-2004-x64
5$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/Toolbar.exe
windows7-x64
7$TEMP/Toolbar.exe
windows10-2004-x64
7$TEMP/sqlite3.exe
windows7-x64
1$TEMP/sqlite3.exe
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 19:34
Behavioral task
behavioral1
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_d105c88fe2e14f3e28a115b6cbadee09.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ZipDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$TEMP/Toolbar.exe
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$TEMP/Toolbar.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$TEMP/sqlite3.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$TEMP/sqlite3.exe
Resource
win10v2004-20241007-en
General
-
Target
$TEMP/Toolbar.exe
-
Size
198KB
-
MD5
5a82a45f2e0aaf617c8d511d43100fe1
-
SHA1
515aa5b88b8c129046706d8542bee3699f62968c
-
SHA256
4761b338dc54c9a3adec6a79024029d5041b75f4f9bb30baf98b5d3ff34d7614
-
SHA512
4811406accf89eac961a349b78449185e894ae4c89a7c380da1e67005c953ef782e57d2370fdc09027bb36586ad57d2476888b33b5913ca74142c72b1c17051a
-
SSDEEP
6144:f4KTJDvFeKBw8v92A7BBNC0kz/ifYxUxBE1T:z1Bv/NwbWTC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2460 GLBD910.tmp -
Loads dropped DLL 3 IoCs
pid Process 2848 Toolbar.exe 2460 GLBD910.tmp 2460 GLBD910.tmp -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Toolbar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language GLBD910.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31 PID 2848 wrote to memory of 2460 2848 Toolbar.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\GLBD910.tmpC:\Users\Admin\AppData\Local\Temp\GLBD910.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$TEMP\Toolbar.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2460
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD5793a2c91c1b687b58809d7bb079457a7
SHA129363e8d0591accb9dc84512c6e634e1e17c591e
SHA256fcb29c8c20a765616126e5a14beb2761ece72c26bd459b9816e65e81770fd3b4
SHA512a50e03b15e0a735d41fe3a5213c454cbb76d934ae27e367f8b0f8a38c1666926bdd161b2a88e7cc7811a9f39635c16d6e2b62c07dd1aee6880639903ecbaa31b
-
Filesize
161KB
MD58c97d8bb1470c6498e47b12c5a03ce39
SHA115d233b22f1c3d756dca29bcc0021e6fb0b8cdf7
SHA256a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
SHA5127ad0b2b0319da52152c2595ee45045d0c06b157cdaaa56ad57dde9736be3e45fd7357949126f80d3e72b21510f9bf69d010d51b3967a7644662808beed067c3f
-
Filesize
12KB
MD5484cb68472473a1a84ff07996bb8c1f6
SHA1bce9d810f2558e73854e7c8e05f122b002558e9a
SHA25615bb390af019d92e1d02771b02335fa360db1bb34bcf4f0c72705027428f4ff1
SHA5125f756d11290e0240fabeab6cb638f7e42024b95b5a44eea6b44dba610919a9d9d5654a87af29ef249fb22bfb9eae7dadd3abb42faa594a465efa1ff358a2fd47