Overview
overview
7Static
static
37b3491e002...18.exe
windows7-x64
67b3491e002...18.exe
windows10-2004-x64
6$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/petronel.dll
windows7-x64
1$TEMP/petronel.dll
windows10-2004-x64
3WindNinja-...ll.exe
windows7-x64
7WindNinja-...ll.exe
windows10-2004-x64
7Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$TEMP/petronel.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$TEMP/petronel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win10v2004-20240508-en
General
-
Target
WindNinja-2.0.1/Uninstall.exe
-
Size
49KB
-
MD5
ed04f76422a68aa282da0adf017f1a96
-
SHA1
63862b6d935ac184b4faef4649ac5be14ddf8505
-
SHA256
9f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6
-
SHA512
59f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255
-
SSDEEP
1536:WwJOoN1oYaoZ5iV685XJPChgdLeAyNJzF:WwJ52Y7ZoH5XJahceAUF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2112 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 2112 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 2752 Uninstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral7/files/0x0034000000016126-2.dat nsis_installer_1 behavioral7/files/0x0034000000016126-2.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2112 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2112 2752 Uninstall.exe 28 PID 2752 wrote to memory of 2112 2752 Uninstall.exe 28 PID 2752 wrote to memory of 2112 2752 Uninstall.exe 28 PID 2752 wrote to memory of 2112 2752 Uninstall.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5ed04f76422a68aa282da0adf017f1a96
SHA163862b6d935ac184b4faef4649ac5be14ddf8505
SHA2569f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6
SHA51259f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255