Overview
overview
7Static
static
3faddca8dc3...18.exe
windows7-x64
7faddca8dc3...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3MahJong2.exe
windows7-x64
3MahJong2.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3aminstall.dll
windows7-x64
1aminstall.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/04/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
faddca8dc34f40b377a8afd26a4910e7_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
faddca8dc34f40b377a8afd26a4910e7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
MahJong2.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MahJong2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
aminstall.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
aminstall.dll
Resource
win10v2004-20240412-en
General
-
Target
Uninstall.exe
-
Size
98KB
-
MD5
c7980b746b65bb560eedc436c61cc631
-
SHA1
c22b3053db2bd827655ee7a96610dbba7474f57e
-
SHA256
641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3
-
SHA512
169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481
-
SSDEEP
1536:AAuU2UTyxtFdkJ3sBCGMKHL3zkTtYYiU4BSSxyFYcWHAt5SckPhSGetbk:Ak5+bFdkJ7HKHLD+6BSSxyFYHOSc6ae
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2300 A~NSISu_.exe -
Loads dropped DLL 6 IoCs
pid Process 2168 Uninstall.exe 2300 A~NSISu_.exe 2300 A~NSISu_.exe 2300 A~NSISu_.exe 2300 A~NSISu_.exe 2300 A~NSISu_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral21/files/0x000b000000015a2d-8.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2300 A~NSISu_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28 PID 2168 wrote to memory of 2300 2168 Uninstall.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe"C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2300
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
604B
MD518f674fd90df51b434d7462f36df4c7a
SHA1a34a69a5804048315f64130f0cf6b719459b9aa3
SHA256527327771aeccda05fbf1890f7f4c77627323cdb2ce33ea62fd4fe5edced4f4d
SHA512b857c3819ff4e4153da18d9f3afab71d91359918d05c787522eeb2c64f0c3d79c4efc4556a1ed2b551b9fdcaeef25b7ed3cf7f5cf12302b88fb596efae0dcb0b
-
Filesize
98KB
MD5c7980b746b65bb560eedc436c61cc631
SHA1c22b3053db2bd827655ee7a96610dbba7474f57e
SHA256641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3
SHA512169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481
-
Filesize
12KB
MD557db62366ef11fdc47922a02031f0492
SHA16d30db5285b653025f94e74b9b045870dc0aeb7a
SHA2562338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
SHA512d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
-
Filesize
4KB
MD5593345196fcd1c553b0702cc026ccccd
SHA184446849c10e0c4d6683072f4c2eea5a085bac2f
SHA256fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d
SHA512b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306