Overview
overview
3Static
static
33c76f5275d...18.exe
windows7-x64
33c76f5275d...18.exe
windows10-2004-x64
3$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
1$PLUGINSDI...ss.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...e.html
windows7-x64
1$PLUGINSDI...e.html
windows10-2004-x64
1$PLUGINSDI...w.html
windows7-x64
1$PLUGINSDI...w.html
windows10-2004-x64
1$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/nswg.dll
windows7-x64
3$PLUGINSDIR/nswg.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
12-07-2024 07:24
Static task
static1
Behavioral task
behavioral1
Sample
3c76f5275d1350f86e220e158337b321_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3c76f5275d1350f86e220e158337b321_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InetLoadEx.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Progress.dll
Resource
win7-20240704-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Progress.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/Welcome.html
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/Welcome.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Welcome_noadw.html
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Welcome_noadw.html
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/nswg.dll
Resource
win7-20240704-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/nswg.dll
Resource
win10v2004-20240709-en
General
-
Target
$PLUGINSDIR/Progress.dll
-
Size
80KB
-
MD5
15e01578481287bbcf32d2217f1b5246
-
SHA1
67a7d05bb2f8b33980867d3352280fa0cd0b4e9f
-
SHA256
61d8f9eba68cc6e2a83ec6d1689b2aa45e06bc32e13cdfcec8b593a14bc8bf70
-
SHA512
9a83832faf20eaef5043f69d468bfe032d790274df25bae73bce4f7830ac83587d7e23dba531bff04951cbed67399386d9ea4337002a99d8cf61de3f8e33b674
-
SSDEEP
768:WCFSITRx/imU5IBAczjPj+NbHHFJUzWwrhABjknWgiLLhfv09jaYhdb5P8mDnbK:+8xzUKBZo0zWWhskjiLwR/5P3b
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4156 wrote to memory of 220 4156 rundll32.exe 83 PID 4156 wrote to memory of 220 4156 rundll32.exe 83 PID 4156 wrote to memory of 220 4156 rundll32.exe 83