Overview
overview
10Static
static
36f76d0c1fb...18.exe
windows7-x64
106f76d0c1fb...18.exe
windows10-2004-x64
10$APPDATA/U...ui.dll
windows7-x64
1$APPDATA/U...ui.dll
windows10-2004-x64
1$APPDATA/U...en.exe
windows7-x64
1$APPDATA/U...en.exe
windows10-2004-x64
1$APPDATA/c...fswipe
ubuntu-22.04-amd64
1$APPDATA/p...mp.dll
windows7-x64
1$APPDATA/p...mp.dll
windows10-2004-x64
1$APPDATA/u...ui.dll
windows7-x64
1$APPDATA/u...ui.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/diaeresis.dll
windows7-x64
4$TEMP/diaeresis.dll
windows10-2004-x64
4$TEMP/name...pt.exe
windows7-x64
$TEMP/name...pt.exe
windows10-2004-x64
Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 18:38
Static task
static1
Behavioral task
behavioral1
Sample
6f76d0c1fb88337cb281b250e2c178fd_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6f76d0c1fb88337cb281b250e2c178fd_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$APPDATA/USER/doinstall/strFormId/logo/msdnmui.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$APPDATA/USER/doinstall/strFormId/logo/msdnmui.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$APPDATA/USER/doinstall/strFormId/logo/resgen.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$APPDATA/USER/doinstall/strFormId/logo/resgen.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$APPDATA/credits/ntfswipe
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral8
Sample
$APPDATA/period/plan/frequency/clean/msddslmp.dll
Resource
win7-20240221-en
Behavioral task
behavioral9
Sample
$APPDATA/period/plan/frequency/clean/msddslmp.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral10
Sample
$APPDATA/u2/mailto/connectt/DbgUrtMui.dll
Resource
win7-20240221-en
Behavioral task
behavioral11
Sample
$APPDATA/u2/mailto/connectt/DbgUrtMui.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral14
Sample
$TEMP/diaeresis.dll
Resource
win7-20240215-en
Behavioral task
behavioral15
Sample
$TEMP/diaeresis.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral16
Sample
$TEMP/namespace/CMAccept.exe
Resource
win7-20240508-en
Behavioral task
behavioral17
Sample
$TEMP/namespace/CMAccept.exe
Resource
win10v2004-20240426-en
General
-
Target
$TEMP/diaeresis.dll
-
Size
10KB
-
MD5
51921a259471561b82e7b37b08cac3a5
-
SHA1
a3d991d42e1861f4db64438969116771bc8dbb81
-
SHA256
32dc82dd46ca4e4937b9f3c31988dde9cd1cfd4c907798d942b13394169f1bf6
-
SHA512
2446084e48688f37e60116c734dc9c8172e3692b2dde6e915c35f89bed7c383c4c62516680b4a701f3a8d29bcfdf7418f9846c302d4a64f042aabe000b07aa7a
-
SSDEEP
192:dWRKKJtAvnh/W+z0DPlZ8GRSkmBxu22HypO00XX:dwJtAf70pRgxdJO00XX
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini rundll32.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 5788 4036 WerFault.exe 82 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3828 wrote to memory of 4036 3828 rundll32.exe 82 PID 3828 wrote to memory of 4036 3828 rundll32.exe 82 PID 3828 wrote to memory of 4036 3828 rundll32.exe 82
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\diaeresis.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\diaeresis.dll,#12⤵
- Drops file in Windows directory
PID:4036 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 5763⤵
- Program crash
PID:5788
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4036 -ip 40361⤵PID:5808
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
131B
MD59848e4efb0abd437d65e6d3d1d973adb
SHA1f427ac7c50b19f66658ae7f92cbaf21110b49a47
SHA256c8b84add37da849977a84fe62badb6cb908be99769edb70d60bcd04c0aec2a3f
SHA512f90f1f65b6b824a526469b8d739f733a54a7f485d8b5f680de7a35fac90786bf6ba5a0b1d62e139663c5ee73b8d687cf32d4ccf188e18c53084ec12d8c216b17