Overview
overview
10Static
static
31e039f9770...18.exe
windows7-x64
101e039f9770...18.exe
windows10-2004-x64
10$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Nwiz.dll
windows7-x64
1Nwiz.dll
windows10-2004-x64
3default_hash.js
ubuntu-18.04-amd64
1default_hash.js
debian-9-armhf
1default_hash.js
debian-9-mips
default_hash.js
debian-9-mipsel
libimalloc.dll
windows7-x64
1libimalloc.dll
windows10-2004-x64
1Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06-05-2024 19:26
Static task
static1
Behavioral task
behavioral1
Sample
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1e039f9770017f09225e58d7759b700a_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
Nwiz.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Nwiz.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
default_hash.js
Resource
ubuntu1804-amd64-20240226-en
Behavioral task
behavioral8
Sample
default_hash.js
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral9
Sample
default_hash.js
Resource
debian9-mipsbe-20240226-en
Behavioral task
behavioral10
Sample
default_hash.js
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral11
Sample
libimalloc.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
libimalloc.dll
Resource
win10v2004-20240419-en
General
-
Target
Nwiz.dll
-
Size
40KB
-
MD5
7f5859cddce6d27bf5ee5a0e5abf80f7
-
SHA1
3fdb34f8c461031de871716f913b6414d71e5f8b
-
SHA256
9be59c18fa3c74fda8d6bbab8ce3b0ac980872261688c62c4ea3a89e7aaf3766
-
SHA512
d4dd6c85edc84b77f3ec96071e6cd3ac29ea62d59852a0707616fb8b70f25fee6ede59818a2c3e9e69d260cee31ade339ea80b9838eb38498d33319dd41ab4b0
-
SSDEEP
384:0GsyoOJGGOzp9soz8mlxAjTTrLtNCyyAC+GAU+kmXjnMZll3:HsvOyzp2pOyHC+HU+kWjMX
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe PID 2732 wrote to memory of 2528 2732 rundll32.exe rundll32.exe