Overview
overview
10Static
static
3863bf0dfa1...18.exe
windows7-x64
10863bf0dfa1...18.exe
windows10-2004-x64
10$APPDATA/f...60.dll
windows7-x64
1$APPDATA/f...60.dll
windows10-2004-x64
1$APPDATA/f...xy.exe
windows7-x64
1$APPDATA/f...xy.exe
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/2006...60.dll
windows7-x64
1$TEMP/2006...60.dll
windows10-2004-x64
1$TEMP/Situ...le.dll
windows7-x64
1$TEMP/Situ...le.dll
windows10-2004-x64
10$TEMP/mode...ap.dll
windows7-x64
1$TEMP/mode...ap.dll
windows10-2004-x64
1$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...UI.dll
windows7-x64
1$TEMP/mode...UI.dll
windows10-2004-x64
1$TEMP/mode...lc.exe
windows7-x64
1$TEMP/mode...lc.exe
windows10-2004-x64
1$TEMP/mode...or.dll
windows7-x64
1$TEMP/mode...or.dll
windows10-2004-x64
1Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240419-en - resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system - submitted
31/05/2024, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
863bf0dfa1169706f566c070a1e11256_JaffaCakes118.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral4
Sample
$APPDATA/for/page_1/13.opends60.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
$APPDATA/for/page_1/MicrosoftXslDebugProxy.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$TEMP/2006/35.opends60.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral12
Sample
$TEMP/2006/35.opends60.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$TEMP/SitulaCystocele.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral14
Sample
$TEMP/SitulaCystocele.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral16
Sample
$TEMP/mode/Thumbs.db/intern/ActiveSyncBootstrap.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral18
Sample
$TEMP/mode/Thumbs.db/intern/MicrosoftVisualStudioUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
$TEMP/mode/Thumbs.db/intern/NatDbgDEUI.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral22
Sample
$TEMP/mode/Thumbs.db/intern/PermCalc.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
$TEMP/mode/Thumbs.db/intern/Vsa7Director.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
General
- Target $TEMP/SitulaCystocele.dll
- Size 50KB
- Sample240531-hhlbhsbb66
- SHA256 18e86106e60613594527c85fe6c97287fc8c3715181a62cb2b4d2258c210b6c8
- MD5 de3f3ceccff80b3b0cc7e8cc58357b70
- SHA1 701387d5e62903e114f4bdf59cd4f89cc6b2ad4e
- SHA512 ad16ea6af2200f7f8a8c0fd0cc1fe5c935942a8789ce057818499b1a51865bb4a0b39a4091f84a2652d2c6ea7569e3829dd5b3043b2d44083a597f3954c2c6db
- SSDEEP 1536:5EOuTAjdpOExDJANAB/qepudoVoD3Qu3IEN:5yA/DJ3
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2052 rundll32.exe - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2052 rundll32.exe - Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2288 wrote to memory of 2052 2288 rundll32.exe 28 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29 PID 2052 wrote to memory of 2132 2052 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SitulaCystocele.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$TEMP\SitulaCystocele.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵PID:2132
-
-