Overview
overview
10Static
static
328f861cbd4...18.exe
windows7-x64
1028f861cbd4...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3js_MmenB33...-rE.js
windows7-x64
3js_MmenB33...-rE.js
windows10-2004-x64
3Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
28f861cbd4ff537d110518dc76cee579_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
28f861cbd4ff537d110518dc76cee579_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
Uninstall.exe
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Uninstall.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
js_MmenB33TOoaWdOmQJH22nF-n0tidgaVJZ1otfad4-rE.js
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
js_MmenB33TOoaWdOmQJH22nF-n0tidgaVJZ1otfad4-rE.js
Resource
win10v2004-20240508-en
General
-
Target
Uninstall.exe
-
Size
75KB
-
MD5
f64e77bc3093b25e62148d784d55267a
-
SHA1
635fc5f0d655bbecbdc06ba3ecece1f0574ec311
-
SHA256
298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584
-
SHA512
086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce
-
SSDEEP
1536:sjoUxZbE+HOI66qkryz9zIXg/EW58gL0AzCa/YR2nbn+m37:sdxNE+Hb+eyz9zIXeEW530ADAqb/L
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 2476 Au_.exe -
Loads dropped DLL 2 IoCs
Processes:
Au_.exepid process 2476 Au_.exe 2476 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Uninstall.exedescription pid process target process PID 1176 wrote to memory of 2476 1176 Uninstall.exe Au_.exe PID 1176 wrote to memory of 2476 1176 Uninstall.exe Au_.exe PID 1176 wrote to memory of 2476 1176 Uninstall.exe Au_.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\InstallOptions.dllFilesize
15KB
MD5f8d9d9418e6e1827ed2b53dd930e48fb
SHA1c78b0e5b274dbbfd032a0f3ed795d82d5ea617c8
SHA2562a2878b54550178144665d4c5f67309f71f1089679ae0f84fa419b8a309a88e4
SHA512510ac31f9e330ec2e6133c1cbe775a955b79b94dc5a84d94b2c59d9b513c35f3786ff8a7f706d04ec2503a4ffc16535624a34e0dcc53e91eedd2321691b617fc
-
C:\Users\Admin\AppData\Local\Temp\nsa53FE.tmp\ioSpecial.iniFilesize
1KB
MD55f7f7392de5ff68a205fc781fb357750
SHA148a54ae335ff89330aa81e9f813676a92d64c342
SHA256847f3764ebd2390ba095a2837bdcf822ac0a92ba07ae8e08c6b02cc8c1044bc2
SHA5124fd334111fef047e673df5c6691788be3acf204f8b5e8b2ff654c295f4ccd4b9bbd45f17f69b3f229af57f9b616683c688644e7ec93a7284f5facdebc762df7e
-
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exeFilesize
75KB
MD5f64e77bc3093b25e62148d784d55267a
SHA1635fc5f0d655bbecbdc06ba3ecece1f0574ec311
SHA256298247e7a75a3de7d17fd9b3c0f403799732f851694c8b204dd4158fc50bd584
SHA512086fa512dfe8dc5f7f4699b3c915b3b05363eff50e5b8e1c22d495ac207824423a335fd0feb5fcac9aec78f83aa68e63583d31871f578df67ad0ef3669e326ce