Overview
overview
7Static
static
3648977ace9...18.exe
windows7-x64
7648977ace9...18.exe
windows10-2004-x64
7$PLUGINSDIR/BDDL.dll
windows7-x64
1$PLUGINSDIR/BDDL.dll
windows10-2004-x64
1$PLUGINSDI...ls.dll
windows7-x64
1$PLUGINSDI...ls.dll
windows10-2004-x64
1$PLUGINSDI...in.dll
windows7-x64
3$PLUGINSDI...in.dll
windows10-2004-x64
3$PLUGINSDIR/dl.dll
windows7-x64
1$PLUGINSDIR/dl.dll
windows10-2004-x64
1$PLUGINSDI...hd.dll
windows7-x64
3$PLUGINSDI...hd.dll
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:46
Static task
static1
Behavioral task
behavioral1
Sample
648977ace948291a404df455bde4e412_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
648977ace948291a404df455bde4e412_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BDDL.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BDDL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/BDLogicUtils.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/BDLogicUtils.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/BDMSkin.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/BDMSkin.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/dl.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/dl.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/tmp6_zbhd.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/tmp6_zbhd.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/tmp6_zbhd.dll
-
Size
608KB
-
MD5
a4239ba6fc0f4c75a77c11ff130d63a5
-
SHA1
9f1262d574b81a0d58367e70cadab3fee2cc6c64
-
SHA256
f25419fc5f0c89ad69c174b19c7d9dd7efa7ff9e21a85abca834d87f0214dcf5
-
SHA512
106f0eb5931209bc383e96d2e7967c1da94e3989953c934aa457cd47480a61cfbdc72c3cef767e96fd1e640090370e587c76b4fda72fe32ad2b716cd1128ee95
-
SSDEEP
12288:caWPGTZHjUjsE9le342WEv5+KgpHc7jDYrUX5:CGTajs3jNvk1G7jDYa5
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2188 1636 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 2768 wrote to memory of 1636 2768 rundll32.exe rundll32.exe PID 1636 wrote to memory of 2188 1636 rundll32.exe WerFault.exe PID 1636 wrote to memory of 2188 1636 rundll32.exe WerFault.exe PID 1636 wrote to memory of 2188 1636 rundll32.exe WerFault.exe PID 1636 wrote to memory of 2188 1636 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp6_zbhd.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2768 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\tmp6_zbhd.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1636 -s 2523⤵
- Program crash
PID:2188