Overview
overview
10Static
static
10126fff08a5...18.exe
windows7-x64
7126fff08a5...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Analizador.dll
windows7-x64
3Analizador.dll
windows10-2004-x64
3Ayuda.exe
windows7-x64
7Ayuda.exe
windows10-2004-x64
7E-mail_Marketing.exe
windows7-x64
10E-mail_Marketing.exe
windows10-2004-x64
10Extractor.exe
windows7-x64
1Extractor.exe
windows10-2004-x64
1Seguridad.dll
windows7-x64
3Seguridad.dll
windows10-2004-x64
3Servidor_em.exe
windows7-x64
1Servidor_em.exe
windows10-2004-x64
1libeay32.dll
windows7-x64
1libeay32.dll
windows10-2004-x64
1ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
140s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 11:02
Behavioral task
behavioral1
Sample
126fff08a5955d42438875e98c23487e_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
126fff08a5955d42438875e98c23487e_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Analizador.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Analizador.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
Ayuda.exe
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
Ayuda.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
E-mail_Marketing.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
E-mail_Marketing.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
Extractor.exe
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
Extractor.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
Seguridad.dll
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
Seguridad.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
Servidor_em.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
Servidor_em.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
libeay32.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
libeay32.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
ssleay32.dll
Resource
win7-20240215-en
Behavioral task
behavioral20
Sample
ssleay32.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20240226-en
General
-
Target
Analizador.dll
-
Size
90KB
-
MD5
79712c20fe2155cf1ab4fa1b07969e9e
-
SHA1
1f45b7aa4c6434e3008d2b8cb9096e8d38dbc0d8
-
SHA256
b9ce82cf7b4f51617a04fe79489fa186a6750e071530d13b303435f739518a99
-
SHA512
ca75f89481f216842874b567e1a5746cb144680d7034470690e3466126f3fbf7dbd6b8f07be41cc98dc7b8f16a4ecfd0aac0fa6d48f44699d2de9592a7f2c3af
-
SSDEEP
1536:U2tof5xxLs8npufZTEoqphLaI+EqeO8uWGMtB5lKJP0uT4PP0uTzuBNGMG3UXBN:hK57A8nAxTEoqp+eOUtLI2uKUXr
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1800 2212 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 1304 wrote to memory of 2212 1304 rundll32.exe rundll32.exe PID 2212 wrote to memory of 1800 2212 rundll32.exe WerFault.exe PID 2212 wrote to memory of 1800 2212 rundll32.exe WerFault.exe PID 2212 wrote to memory of 1800 2212 rundll32.exe WerFault.exe PID 2212 wrote to memory of 1800 2212 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Analizador.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Analizador.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2212 -s 2243⤵
- Program crash
PID:1800