Overview
overview
7Static
static
705a4836d3e...18.exe
windows7-x64
705a4836d3e...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...rb.dll
windows7-x64
3$PLUGINSDI...rb.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...la.rtf
windows7-x64
4$PLUGINSDI...la.rtf
windows10-2004-x64
1$PLUGINSDI...ay.dll
windows7-x64
7$PLUGINSDI...ay.dll
windows10-2004-x64
7$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ML.dll
windows7-x64
3$PLUGINSDI...ML.dll
windows10-2004-x64
3$PLUGINSDI...ry.dll
windows7-x64
3$PLUGINSDI...ry.dll
windows10-2004-x64
3$R1/$_1_/U...ll.exe
windows7-x64
7$R1/$_1_/U...ll.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3Analysis
-
max time kernel
94s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 16:51
Behavioral task
behavioral1
Sample
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
05a4836d3e6e9c98040f457a1d6f78e9_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InvokeShellVerb.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win7-20240215-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/ask_eula.rtf
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsArray.dll
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsArray.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisXML.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/registry.dll
Resource
win7-20240419-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/registry.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral29
Sample
$R1/$_1_/Uninstall.exe
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$R1/$_1_/Uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
General
-
Target
$R1/$_1_/Uninstall.exe
-
Size
505KB
-
MD5
ee2cf86633ae043d006c9c8fded2a999
-
SHA1
c18889ee32620e40a366f8cbd5e62e26f5dc2b37
-
SHA256
02b631c95364397d1ec91c65007f00b9d7baafef05ddb51b7b9fe9ba35234f53
-
SHA512
57695a4e408dd07f8d0c8c3befd7d2a2710dc1f50fefe61a4961729bca2d611925e63390d1375d3e5270930ee944b6d4e2858891b05d4d9d8c96c260b7e4bb4f
-
SSDEEP
6144:r50gUCimyti5ELY4jurNXa4bbOV1p7VulOCkqt:d0gOmwO4SrNXhOV1p7klO8t
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 4704 Au_.exe -
Loads dropped DLL 7 IoCs
Processes:
Au_.exepid process 4704 Au_.exe 4704 Au_.exe 4704 Au_.exe 4704 Au_.exe 4704 Au_.exe 4704 Au_.exe 4704 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Au_.exedescription pid process Token: SeDebugPrivilege 4704 Au_.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Uninstall.exedescription pid process target process PID 3088 wrote to memory of 4704 3088 Uninstall.exe Au_.exe PID 3088 wrote to memory of 4704 3088 Uninstall.exe Au_.exe PID 3088 wrote to memory of 4704 3088 Uninstall.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\Uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$R1\$_1_\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\System.dllFilesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\UAC.dllFilesize
13KB
MD5a88baad3461d2e9928a15753b1d93fd7
SHA1bb826e35264968bbc3b981d8430ac55df1e6d4a6
SHA256c5ab2926c268257122d0342739e73573d7eeda34c861bc7a68a02cbc69bd41af
SHA5125edcf46680716930da7fd1a41b8b0426f057cf4becefb3ee84798ec8b449726afb822fb626c4942036a1ae3bb937184d1f71d0e45075abb5bf167f5d833df43a
-
C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\apphelp.dllFilesize
1.8MB
MD5bc8f81f42505bf9def590d7fe89da46c
SHA15f648334bd6d09c7388be43deb7461d4a47e36fe
SHA256a74e88300bc96ff413dd0b289a5023649592a7f2e68793d0a5ff71c6dc5f4130
SHA51291b08f39675f9456f05c9b2939eba3c778b0ce7f9558ecba6aea36832d526d01a9da4196e56023cf45b3d147834db7bcd9aef2997a103a497c9c527d13126b6c
-
C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\nsDialogs.dllFilesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
C:\Users\Admin\AppData\Local\Temp\nsq2F2F.tmp\registry.dllFilesize
24KB
MD52b7007ed0262ca02ef69d8990815cbeb
SHA12eabe4f755213666dbbbde024a5235ddde02b47f
SHA2560b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d
SHA512aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
505KB
MD5ee2cf86633ae043d006c9c8fded2a999
SHA1c18889ee32620e40a366f8cbd5e62e26f5dc2b37
SHA25602b631c95364397d1ec91c65007f00b9d7baafef05ddb51b7b9fe9ba35234f53
SHA51257695a4e408dd07f8d0c8c3befd7d2a2710dc1f50fefe61a4961729bca2d611925e63390d1375d3e5270930ee944b6d4e2858891b05d4d9d8c96c260b7e4bb4f
-
memory/4704-15-0x00000000030F0000-0x0000000003149000-memory.dmpFilesize
356KB