Overview
overview
7Static
static
37b3491e002...18.exe
windows7-x64
67b3491e002...18.exe
windows10-2004-x64
6$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$TEMP/petronel.dll
windows7-x64
1$TEMP/petronel.dll
windows10-2004-x64
3WindNinja-...ll.exe
windows7-x64
7WindNinja-...ll.exe
windows10-2004-x64
7Analysis
-
max time kernel
134s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7b3491e0028d443f11989efaeb0fbec2_JaffaCakes118.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$TEMP/petronel.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$TEMP/petronel.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
WindNinja-2.0.1/Uninstall.exe
Resource
win10v2004-20240508-en
General
-
Target
WindNinja-2.0.1/Uninstall.exe
-
Size
49KB
-
MD5
ed04f76422a68aa282da0adf017f1a96
-
SHA1
63862b6d935ac184b4faef4649ac5be14ddf8505
-
SHA256
9f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6
-
SHA512
59f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255
-
SSDEEP
1536:WwJOoN1oYaoZ5iV685XJPChgdLeAyNJzF:WwJ52Y7ZoH5XJahceAUF
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 752 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 752 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral8/files/0x00090000000233f3-3.dat nsis_installer_1 behavioral8/files/0x00090000000233f3-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 928 wrote to memory of 752 928 Uninstall.exe 83 PID 928 wrote to memory of 752 928 Uninstall.exe 83 PID 928 wrote to memory of 752 928 Uninstall.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\Uninstall.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\WindNinja-2.0.1\2⤵
- Deletes itself
- Executes dropped EXE
PID:752
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5ed04f76422a68aa282da0adf017f1a96
SHA163862b6d935ac184b4faef4649ac5be14ddf8505
SHA2569f652f774eaeaa769f245bfc7e3a6d11b04068cc1618f49dc760eea3518b2bb6
SHA51259f3f8d7fbda57ee7f735014c4a7c2ddbb97a35c48725392fe1528998db9cdb8d2a69fbb068bd20cfaf58b5b3ce79af34c270f9a2bcd6e89e7ee21afe3aa8255