Overview
overview
10Static
static
362a3384531...18.exe
windows7-x64
1062a3384531...18.exe
windows10-2004-x64
7$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 08:20
Static task
static1
Behavioral task
behavioral1
Sample
62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
62a3384531a6f4d2c74980833b8f01c0_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
Uninstall.exe
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
Uninstall.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240426-en
General
-
Target
$PLUGINSDIR/StartMenu.dll
-
Size
7KB
-
MD5
12281b59f907027f4d374b8423e2b0f9
-
SHA1
21216630633bb6cc4aa9b1c5873f345bbe06b74c
-
SHA256
1cc68f4aef76d70d7326853f0e604ff3ac926c1dfe7aee7ad69a3259280a4e66
-
SHA512
7c8c7a5c7f8e6d7a0b5d54ad1bfc34831358487985bd64459cd22f45f82385f4740e7a62048b01759b79e3d0f05ccb8152d63c3d864f308146ce5c746a9296b6
-
SSDEEP
96:qgiqVPb3X8K8Kdr3gEq6nNdMk6Qiw290+q6LDtJ1tR3hhEl7y:qgiqVPgK8K9eIdE9B/tVhg7
Malware Config
Signatures
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1216 1588 WerFault.exe rundll32.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
rundll32.exerundll32.exedescription pid process target process PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1736 wrote to memory of 1588 1736 rundll32.exe rundll32.exe PID 1588 wrote to memory of 1216 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 1216 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 1216 1588 rundll32.exe WerFault.exe PID 1588 wrote to memory of 1216 1588 rundll32.exe WerFault.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\StartMenu.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 2243⤵
- Program crash