Overview
overview
10Static
static
328f861cbd4...18.exe
windows7-x64
1028f861cbd4...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3js_MmenB33...-rE.js
windows7-x64
3js_MmenB33...-rE.js
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-05-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
28f861cbd4ff537d110518dc76cee579_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28f861cbd4ff537d110518dc76cee579_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
js_MmenB33TOoaWdOmQJH22nF-n0tidgaVJZ1otfad4-rE.js
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
js_MmenB33TOoaWdOmQJH22nF-n0tidgaVJZ1otfad4-rE.js
Resource
win10v2004-20240508-en
General
-
Target
Uninstall.exe
-
Size
75KB
-
MD5
f64e77bc3093b25e62148d784d55267a
-
SHA1
635fc5f0d655bbecbdc06ba3ecece1f0574ec311
-
SHA256
298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584
-
SHA512
086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce
-
SSDEEP
1536:sjoUxZbE+HOI66qkryz9zIXg/EW58gL0AzCa/YR2nbn+m37:sdxNE+Hb+eyz9zIXeEW530ADAqb/L
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 1672 Au_.exe -
Loads dropped DLL 3 IoCs
Processes:
Uninstall.exeAu_.exepid process 756 Uninstall.exe 1672 Au_.exe 1672 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Au_.exepid process 1672 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
Uninstall.exedescription pid process target process PID 756 wrote to memory of 1672 756 Uninstall.exe Au_.exe PID 756 wrote to memory of 1672 756 Uninstall.exe Au_.exe PID 756 wrote to memory of 1672 756 Uninstall.exe Au_.exe PID 756 wrote to memory of 1672 756 Uninstall.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsd234B.tmp\ioSpecial.iniFilesize
1KB
MD5baa6f73a0a2dcbdf6456c3af197fadee
SHA1fe56e244aaff451035f415b9dfd8b48879565ead
SHA2564648783c11860351a82de8afc4b0756669b42ceddaad47fc212192f2981013c4
SHA51275926fddd5ce3cde8bf3e75782fde8c7730b72299c63b2134fe598618ec675b5ab6c77f4ccfb968260451d4828c9952ccdcb4e2cc071fc0b1d685ed555175c0d
-
C:\Users\Admin\AppData\Local\Temp\nsd234B.tmp\ioSpecial.iniFilesize
1KB
MD532e67a6924e6f9ddb51e1fc28218c7fc
SHA1aba16991b11e85844cc1751e45b74eb7d17ea19d
SHA25624a436446e1e389c2a3963adf210a0eed6898cbaf139497c97361dfe4f4d9657
SHA5121621678b400c98792fffc94bd4eb52715e48b135917da52757351f1baf6733e61bc313c551dab704cbec92a55be0c49aa549862cf85d39541fa7a26ef07c9846
-
\Users\Admin\AppData\Local\Temp\nsd234B.tmp\InstallOptions.dllFilesize
15KB
MD5f8d9d9418e6e1827ed2b53dd930e48fb
SHA1c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA2562a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
SHA512510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
-
\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
75KB
MD5f64e77bc3093b25e62148d784d55267a
SHA1635fc5f0d655bbecbdc06ba3ecece1f0574ec311
SHA256298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584
SHA512086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce