Overview
overview
7Static
static
3faddca8dc3...18.exe
windows7-x64
7faddca8dc3...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3MahJong2.exe
windows7-x64
3MahJong2.exe
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3aminstall.dll
windows7-x64
1aminstall.dll
windows10-2004-x64
3Analysis
-
max time kernel
159s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19/04/2024, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
faddca8dc34f40b377a8afd26a4910e7_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
faddca8dc34f40b377a8afd26a4910e7_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
MahJong2.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
MahJong2.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/GameuxInstallHelper.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
aminstall.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
aminstall.dll
Resource
win10v2004-20240412-en
General
-
Target
Uninstall.exe
-
Size
98KB
-
MD5
c7980b746b65bb560eedc436c61cc631
-
SHA1
c22b3053db2bd827655ee7a96610dbba7474f57e
-
SHA256
641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3
-
SHA512
169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481
-
SSDEEP
1536:AAuU2UTyxtFdkJ3sBCGMKHL3zkTtYYiU4BSSxyFYcWHAt5SckPhSGetbk:Ak5+bFdkJ7HKHLD+6BSSxyFYHOSc6ae
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4712 A~NSISu_.exe -
Loads dropped DLL 2 IoCs
pid Process 4712 A~NSISu_.exe 4712 A~NSISu_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral22/files/0x00070000000233ba-4.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2724 wrote to memory of 4712 2724 Uninstall.exe 92 PID 2724 wrote to memory of 4712 2724 Uninstall.exe 92 PID 2724 wrote to memory of 4712 2724 Uninstall.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe"C:\Users\Admin\AppData\Local\Temp\A~NSISu_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:81⤵PID:1052
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5c7980b746b65bb560eedc436c61cc631
SHA1c22b3053db2bd827655ee7a96610dbba7474f57e
SHA256641d44938b8e9c068af8328bf6234a3b2fb6e2a2e4a551b5ebc18bd35f9d92c3
SHA512169afdf9626490e303198670709670a45f07ce828f4ecc95a96c5530a072d0fdfa69a541d832de58e24f2a6f352dd4d82b06bdabae19ac785c06d5091fe8f481
-
Filesize
12KB
MD557db62366ef11fdc47922a02031f0492
SHA16d30db5285b653025f94e74b9b045870dc0aeb7a
SHA2562338752092918db8e068d55bea61f8cdeb9be37b6e6d30a730d9703b169b08b4
SHA512d0257e02370863e07feb9346b88d87a102089f0c48aea13e069e55a14f0f6db51fb3d5f41ed5d2f39e36b612f4b6194a6b7c059709808bfb23ded89d0b0a3db5
-
Filesize
4KB
MD5593345196fcd1c553b0702cc026ccccd
SHA184446849c10e0c4d6683072f4c2eea5a085bac2f
SHA256fb4a4bea088b8dbf2adda6fdeb50be4b96bf20ba62bd9ac64b68ea628166a28d
SHA512b28da01bec7a34a493316606c7406c06d0b278f1318563874f037caf203c2ec261c3f5c2a1790c6c177537bbb0f4dd0b7be482976f7114f70be75b5e4b311306
-
Filesize
604B
MD53d32d6735fe8bf65738959e579760638
SHA15b31db88b4609556b13d20fcd57f8e352c1aa851
SHA2567b2002e59ca42a76c85f0c6d1766dee31401d55fd1659978479af8b03d023350
SHA51264b99a9f0c7ea81bc2181398b0296d308bf8d276216e7711c34a27ff744165a948c496b24bd6cc0071367fba0122e2df550a5796f9c8d3d39625243b7e700209