Overview
overview
7Static
static
743e45b0caa...18.exe
windows7-x64
743e45b0caa...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3System/Sha...p3.exe
windows7-x64
7System/Sha...p3.exe
windows10-2004-x64
7System/Sha...ch.htm
windows7-x64
1System/Sha...ch.htm
windows10-2004-x64
1System/Sha...yt.htm
windows7-x64
1System/Sha...yt.htm
windows10-2004-x64
1System/Sha...ons.js
windows7-x64
3System/Sha...ons.js
windows10-2004-x64
3System/Sha...ion.js
windows7-x64
3System/Sha...ion.js
windows10-2004-x64
3System/Sha...ead.js
windows7-x64
3System/Sha...ead.js
windows10-2004-x64
3libeay32.dll
windows7-x64
1libeay32.dll
windows10-2004-x64
1sqlite3.dll
windows7-x64
3sqlite3.dll
windows10-2004-x64
3ssleay32.dll
windows7-x64
1ssleay32.dll
windows10-2004-x64
1Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 01:04
Behavioral task
behavioral1
Sample
43e45b0caad8d0e8f94b8c7fc2c2bf8a_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
43e45b0caad8d0e8f94b8c7fc2c2bf8a_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
System/Shared/Utils/cmdmp3.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
System/Shared/Utils/cmdmp3.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
System/Shared/Utils/html/twitch.htm
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
System/Shared/Utils/html/twitch.htm
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
System/Shared/Utils/html/yt.htm
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
System/Shared/Utils/html/yt.htm
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
System/Shared/Utils/js/definitions.js
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
System/Shared/Utils/js/definitions.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
System/Shared/Utils/js/execution.js
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
System/Shared/Utils/js/execution.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
System/Shared/Utils/js/thread.js
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
System/Shared/Utils/js/thread.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
libeay32.dll
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
libeay32.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
sqlite3.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
sqlite3.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
ssleay32.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
ssleay32.dll
Resource
win10v2004-20240508-en
General
-
Target
ssleay32.dll
-
Size
330KB
-
MD5
5dbf9338e47e43bcee17f2da9f4bffc5
-
SHA1
eda920cf525e18bed7280352a02b0f3a7eec552f
-
SHA256
a78a1c2cba9ca1f057851aa43ecc34080fd607aa46026a5655cde8270dda3a05
-
SHA512
02eb426f6c8a5469b42c82ab0c25b59794eca21444f2114b603b399a9aca03bc558dbc4f6e6dd669dd1b341c3304d99fb207430cdc6770459850622f6fd9f1df
-
SSDEEP
6144:vgnOGg4dYb2HX5x9iJ64iqu7Zh6CMXl8h+i6z1tWjrP74h/vbA28eq7QvvygTUER:vw84dYyHX5x9a64iqUL6CMXl8Mi6z1tj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4808 wrote to memory of 840 4808 rundll32.exe 82 PID 4808 wrote to memory of 840 4808 rundll32.exe 82 PID 4808 wrote to memory of 840 4808 rundll32.exe 82