Overview
overview
7Static
static
37b3491e002...18.exe
windows7-x64
67b3491e002...18.exe
windows10-2004-x64
6$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/petronel.dll
windows7-x64
1$TEMP/petronel.dll
windows10-2004-x64
3WindNinja-...ll.exe
windows7-x64
7WindNinja-...ll.exe
windows10-2004-x64
7Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$TEMP/petronel.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$TEMP/petronel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win10v2004-20240508-en
General
-
Target
$TEMP/petronel.dll
-
Size
10KB
-
MD5
437b11c6cce872c4c7e94b30e5812997
-
SHA1
219f7dcf754dba48c53cf3cde5637cc4adceb3cc
-
SHA256
4a5164acce1c631285a09353b11e318426800801cac515bde8e76a10bac6130f
-
SHA512
11ea28de7d274a58eda40e2eda176de898558cea2cff4045b27f4282baa5d0cfed1cc1c4f49abb7bbcf79fa70585424e9ce5dd642fe5f98a7db948a21b2442c2
-
SSDEEP
192:oy0X5kKzSZAwVFhSv4gZRnRH6rfDkjkky:ot5kK+ZAwVFhkZxRHeQy
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28 PID 2028 wrote to memory of 2852 2028 rundll32.exe 28