Overview
overview
10Static
static
331318ee805...18.exe
windows7-x64
1031318ee805...18.exe
windows10-2004-x64
10$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3403-3.htm
windows7-x64
1403-3.htm
windows10-2004-x64
1HelpButton.dll
windows7-x64
3HelpButton.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
10-05-2024 21:48
Static task
static1
Behavioral task
behavioral1
Sample
31318ee80570c7168708575f032ac63f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
31318ee80570c7168708575f032ac63f_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240215-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
403-3.htm
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
403-3.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
HelpButton.dll
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
HelpButton.dll
Resource
win10v2004-20240508-en
General
-
Target
$PLUGINSDIR/System.dll
-
Size
11KB
-
MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b
-
SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785
-
SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1
-
SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8
-
SSDEEP
96:zPDYcJ+nx4vVp76JX7zBlkCg21Fxz4THxtrqw1at0JgwLEjo+OB3yUVCdl/wNj+y:zPtkuWJX7zB3kGwfy0nyUVsxCjOM61u
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2212 2316 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2028 wrote to memory of 2316 2028 rundll32.exe rundll32.exe PID 2316 wrote to memory of 2212 2316 rundll32.exe WerFault.exe PID 2316 wrote to memory of 2212 2316 rundll32.exe WerFault.exe PID 2316 wrote to memory of 2212 2316 rundll32.exe WerFault.exe PID 2316 wrote to memory of 2212 2316 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\System.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2316 -s 2243⤵
- Program crash