Analysis
-
max time kernel
91s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02-04-2024 07:29
Static task
static1
Behavioral task
behavioral1
Sample
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
864c6461a405628b69fb52e1cad9d845_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/olldmhffoaz.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/olldmhffoaz.dll
Resource
win10v2004-20231215-en
General
-
Target
$PLUGINSDIR/olldmhffoaz.dll
-
Size
22KB
-
MD5
374e00e1b931d7e06c74d4ce9c9476a3
-
SHA1
5f199903f9b64b10e218b4d98621f7c2b02b11d9
-
SHA256
80f175c88444e4c1388bdc3560f9c44b9fb3a24861f20bbedab4b5dfd69d10ef
-
SHA512
470793bc592c7ec78cc1dec91ebe48d6136c60d179512782b8b41532d372a8293c53913653931b3c74d1544fb038e1fc649cac745bd65310c1ffc88606350ad4
-
SSDEEP
384:4nMclcY5oSkzLuF1L0hF2IQwAtTbGB1jMbo:4Mc+YSSkzLuFZkw9w+fGBZO
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 4804 2236 WerFault.exe 84 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3708 wrote to memory of 2236 3708 rundll32.exe 84 PID 3708 wrote to memory of 2236 3708 rundll32.exe 84 PID 3708 wrote to memory of 2236 3708 rundll32.exe 84 PID 2236 wrote to memory of 4916 2236 rundll32.exe 85 PID 2236 wrote to memory of 4916 2236 rundll32.exe 85 PID 2236 wrote to memory of 4916 2236 rundll32.exe 85 PID 2236 wrote to memory of 4916 2236 rundll32.exe 85
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\olldmhffoaz.dll,#13⤵PID:4916
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2236 -s 7163⤵
- Program crash
PID:4804
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2236 -ip 22361⤵PID:4888
Network
-
Remote address:8.8.8.8:53Request133.211.185.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request107.211.222.173.in-addr.arpaIN PTRResponse107.211.222.173.in-addr.arpaIN PTRa173-222-211-107deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request134.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request79.121.231.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request152.33.115.104.in-addr.arpaIN PTRResponse152.33.115.104.in-addr.arpaIN PTRa104-115-33-152deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
73 B 147 B 1 1
DNS Request
133.211.185.52.in-addr.arpa
-
74 B 141 B 1 1
DNS Request
107.211.222.173.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
134.32.126.40.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
79.121.231.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
217.135.221.88.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
152.33.115.104.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa