Analysis
-
max time kernel
133s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07-05-2024 20:53
Static task
static1
Behavioral task
behavioral1
Sample
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
21af27ba9ac8e0dc4124c57f82b7e514_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
NsResize.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
NsResize.dll
Resource
win10v2004-20240419-en
General
-
Target
NsResize.dll
-
Size
28KB
-
MD5
d53bd2d5591a78ea15b3bd59e2652bd6
-
SHA1
40968bcae13ee63469d241200679b25dfa5fdd4c
-
SHA256
1734bceb77dab6739b80575fd7ee87c437327d8eb147339e1d93b7d3235c5394
-
SHA512
c07bbab95251f16ac4b1c03e0324792b35badd111cced2e5c8e0de467226e572edfe5ca6e528c3494664f2569774f6a422806f54883cc2ef3726e21f4a011f5b
-
SSDEEP
192:CQRZmWPG1Cg3ROenIw77QXyDWscAIJJgjZZZZIIqIqIAY:CQRZmH1C0tIw7QyW8sWZZZZ
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2620 4576 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 652 wrote to memory of 4576 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 4576 652 rundll32.exe rundll32.exe PID 652 wrote to memory of 4576 652 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NsResize.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NsResize.dll,#12⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 5603⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4576 -ip 45761⤵