Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18/04/2024, 13:04
Static task
static1
Behavioral task
behavioral1
Sample
f80d4220549e0549d6fe23adc6ab0431_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f80d4220549e0549d6fe23adc6ab0431_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/installhelper.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/installhelper.dll
Resource
win10v2004-20240412-en
General
-
Target
$PLUGINSDIR/installhelper.dll
-
Size
14KB
-
MD5
ff5a82071907bc0846a752a93116049d
-
SHA1
84d3f9d70b65738d14d27f0eec94358dc0eb5b87
-
SHA256
0936ab601a70633041034ff7fb846a6cc3c0a25874e20b69fee99f5c798c2eb6
-
SHA512
89863224464ac2eb623b4cec5c55525838d04cb51b9057d80d43800c50e2cfc697e5b337836dedeb4c942d9f731dbc2a5c901633b0f391893f26800180d5f3ce
-
SSDEEP
192:MtGZOIbntLtOHJXWSGngME0P++geM/79xd+FSU3/0gSdCKqa9Ow0VxCBDm5XBnSv:MGnJQHg60w7nGSU3MgSEXasFkBDTs1O
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28 PID 1108 wrote to memory of 2188 1108 rundll32.exe 28
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\installhelper.dll,#12⤵PID:2188
-