Overview
overview
10Static
static
3a454cf45f1...18.exe
windows7-x64
10a454cf45f1...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Cdx.exe
windows7-x64
9Cdx.exe
windows10-2004-x64
9Setup.exe
windows7-x64
10Setup.exe
windows10-2004-x64
10Two.vbs
windows7-x64
6Two.vbs
windows10-2004-x64
6enigma_ide.dll
windows7-x64
1enigma_ide.dll
windows10-2004-x64
1enigma_ide64.dll
windows7-x64
1enigma_ide64.dll
windows10-2004-x64
1udis.dll
windows7-x64
1udis.dll
windows10-2004-x64
3General
-
Target
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118
-
Size
4.3MB
-
Sample
240613-htwlmasepk
-
MD5
a454cf45f16ce0a03a2656fcdc05df63
-
SHA1
a1ab92e80ba89a9e285c52909c1aaadd337baceb
-
SHA256
49febd721b50c554167b59bc876a1a261896822096e39357e67cf9ef9dbaaae4
-
SHA512
3a9ffdffedae0a34d8dd6f43be94a0455505076ed0515b47d42c93b19ba95f39cdf71618de74119e21fba1df89895edc2c93dd45d46743a72462c1865760748d
-
SSDEEP
98304:6FSlDLW2AYidomeDyekTVEUF/1bE0OFi2i+GR1ZUl2tfi3eDDJyA1f7Zj:AaLhGTeDMTyUrbE0D5+M02weRyAF7F
Static task
static1
Behavioral task
behavioral1
Sample
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
Cdx.exe
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
Cdx.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Setup.exe
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
Two.vbs
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
Two.vbs
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
enigma_ide.dll
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
enigma_ide.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
enigma_ide64.dll
Resource
win7-20240611-en
Behavioral task
behavioral22
Sample
enigma_ide64.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
udis.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
udis.dll
Resource
win10v2004-20240611-en
Malware Config
Extracted
cryptbot
nife04.info
Targets
-
-
Target
a454cf45f16ce0a03a2656fcdc05df63_JaffaCakes118
-
Size
4.3MB
-
MD5
a454cf45f16ce0a03a2656fcdc05df63
-
SHA1
a1ab92e80ba89a9e285c52909c1aaadd337baceb
-
SHA256
49febd721b50c554167b59bc876a1a261896822096e39357e67cf9ef9dbaaae4
-
SHA512
3a9ffdffedae0a34d8dd6f43be94a0455505076ed0515b47d42c93b19ba95f39cdf71618de74119e21fba1df89895edc2c93dd45d46743a72462c1865760748d
-
SSDEEP
98304:6FSlDLW2AYidomeDyekTVEUF/1bE0OFi2i+GR1ZUl2tfi3eDDJyA1f7Zj:AaLhGTeDMTyUrbE0D5+M02weRyAF7F
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Blocklisted process makes network request
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Executes dropped EXE
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
bf712f32249029466fa86756f5546950
-
SHA1
75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
-
SHA256
7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
-
SHA512
13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
SSDEEP
192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
Score3/10 -
-
-
Target
$PLUGINSDIR/UAC.dll
-
Size
14KB
-
MD5
adb29e6b186daa765dc750128649b63d
-
SHA1
160cbdc4cb0ac2c142d361df138c537aa7e708c9
-
SHA256
2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
-
SHA512
b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
-
SSDEEP
192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
Score3/10 -
-
-
Target
$PLUGINSDIR/UserInfo.dll
-
Size
4KB
-
MD5
c7ce0e47c83525983fd2c4c9566b4aad
-
SHA1
38b7ad7bb32ffae35540fce373b8a671878dc54e
-
SHA256
6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae
-
SHA512
ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e
Score3/10 -
-
-
Target
$PLUGINSDIR/nsDialogs.dll
-
Size
9KB
-
MD5
4ccc4a742d4423f2f0ed744fd9c81f63
-
SHA1
704f00a1acc327fd879cf75fc90d0b8f927c36bc
-
SHA256
416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
-
SHA512
790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
SSDEEP
192:SbEunjqjIcESwFlioU3M0LLF/t8t9pKSfOi:SbESjFCw6oWPFl8jfOi
Score3/10 -
-
-
Target
$PLUGINSDIR/nsExec.dll
-
Size
6KB
-
MD5
132e6153717a7f9710dcea4536f364cd
-
SHA1
e39bc82c7602e6dd0797115c2bd12e872a5fb2ab
-
SHA256
d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2
-
SHA512
9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1
-
SSDEEP
96:M/SspqrIYxLPEQhThvov3TE4/2Sa5P9QFFYzOx4uF3sbSEI5LP39sQvM:M/QUG7lhvov36S5FcUjliSEI5LuQ
Score3/10 -
-
-
Target
Cdx.exe
-
Size
2.0MB
-
MD5
eb57e84905bea5e75e717d0edb58a8b6
-
SHA1
fbd7ed1a3a2c6ed09ddd3675d5b3711b02cc1c02
-
SHA256
d6a9b164f3e3faa8d75a28f519682d11829a8975f5a88b1357de88a253b67187
-
SHA512
728b034d71f40ae2afd06058b88755752233d78c73518ef75f08e353f6d8deaee308a93a312dba0e249590019245d848c724481e9333df71ec062f00b0e26727
-
SSDEEP
49152:Uemhr7hs8FqeS292UE33tsvw1rwG0vbS:UeO728geV92RIK
Score9/10-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
Setup.exe
-
Size
2.2MB
-
MD5
282e9b884ace169eb8d641e65a570910
-
SHA1
a14f8ae9158cbd7032cc177a25d7d952bb85b363
-
SHA256
a664ad37a7cdbf3f0b1bc9aa46f4d5a945cc4f65f30f1782de15b67c8cac26cc
-
SHA512
1dada2b0fc93ff8e6c2611d59e32c725bd008add73575aa0ae69a195beb69b9df2949e082990dcf9856542693fe5998e8deed366ed4fd136e5b39f36e7221249
-
SSDEEP
49152:/ojC37WKNrt0ZBjCVMIgEiXNLSJzmeOTyJ6P16:/oC37HkZBjCVMIUbTyJ6P16
-
Identifies VirtualBox via ACPI registry values (likely anti-VM)
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Identifies Wine through registry keys
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-
-
-
Target
Two.vbs
-
Size
126B
-
MD5
c6362e3c5585f24a9e9a2712c00c52ff
-
SHA1
9259b9609313386f004328d2c306820eae01a587
-
SHA256
184ca5b2737175e0828f3546d483778c95e23720f1375deac0090c2fe415e208
-
SHA512
59ac94fdb6f41d6dc5cbea1855897759f35032ac922b936a0b39a21b6aafb0c862c5d419afa31c0b81f106f2ce06b2909cdb5fb713534fbe36202c5a4fedfeaa
Score6/10-
Legitimate hosting services abused for malware hosting/C2
-
-
-
Target
enigma_ide.dll
-
Size
18KB
-
MD5
b7b200d4c9716ea98858570e9cb53658
-
SHA1
19d145b80a7367b4845f1cc1528b9238d9836add
-
SHA256
e2ee71162fa60d278b8c833a4487e33fcef771e485a350f3e9fb2365909f214e
-
SHA512
5b26ebcabd2dcf7350444f781d1b6d81e12aa4c4fd3aa101e0978f57146f2fd9a532daaa4e3d83ed828ae6afc56cbd35db2b2c26c84081ecfd148b5f3a5611f6
-
SSDEEP
384:uezhZEAyI91y8yu9pl0SMPAzVTZgcFhKUdx5:7c8yu/uQNZgcF/d
Score1/10 -
-
-
Target
enigma_ide64.dll
-
Size
41KB
-
MD5
39db21ffd436484891026a5e99710b26
-
SHA1
2b736f826bd2d7ce215f8048b5f73d0b330b12b0
-
SHA256
5141f9f501eb6c8f402db79f99b5a21998bd7ce1e28eb077c565e34b2a2be891
-
SHA512
47debf6588f27454414a0a2b4eae6ba2ade7ecd00802ad1bf8f6c52a3b1a64a025149a953743587d46dc5e392e12350329465b31c206a40ace64c77a33d4705e
-
SSDEEP
768:QxyTrKwS3DjRWxNysLx/rlqKtkKZEZvHYkc/Fv:HTrrSaRlxDm3c/
Score1/10 -
-
-
Target
udis.dll
-
Size
129KB
-
MD5
88e01cf86d15be0df1209c5f0f76e4f5
-
SHA1
6f0a0e19acdf66764c5fd0a03c1787a982746c6c
-
SHA256
4f21456111057cfae3147c674573a3f72edc2ab22d1ea2b1b07611bfe9678eca
-
SHA512
6c1a3a9255b681a877ccc1fb088bce77437c40cfd5e4592064dd7b9a8554630b2beb6affcd2f9681889e013d27c9219f10139fe86e5678968236baa4482ff4c6
-
SSDEEP
1536:3oytRJNwZ2wcUH8jeo46JH5ujVrWpPwMmOZoqqPu23ipyqb1EE4:YyM6UcjznCWKOZo/Pu2iN1
Score3/10 -