Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-06-2024 10:14
Static task
static1
Behavioral task
behavioral1
Sample
0dafe529109bf5d41408d83da99facc3_JaffaCakes118.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
0dafe529109bf5d41408d83da99facc3_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
u9anuq.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
u9anuq.dll
Resource
win10v2004-20240508-en
General
-
Target
u9anuq.dll
-
Size
11KB
-
MD5
89df018dd4fd875d5b144c0167653a07
-
SHA1
c7934525cfedad07d92eba5f5f3f04211f3d619a
-
SHA256
2a3fb636b37575a7b32e7ed1ae6403057e324ae4537e4392777a22ee79a77fe2
-
SHA512
d5ff8091aab89c0c788d8c1a0ce5ae048284eca5f6f864d654e832764bc77eac6ba92ddc03c32c8d9a817347722bd5f9db4acf10397996d7434f798dc54269bb
-
SSDEEP
192:+1O/kW4E4WPVBTxicL2lt4S3cGCfEzIWZcX/8yJpq:oONbB9BlJLgt4SsdEzIN0yXq
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe 2028 rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe PID 2156 wrote to memory of 2028 2156 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u9anuq.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\u9anuq.dll,#12⤵
- Suspicious behavior: EnumeratesProcesses