Overview
overview
7Static
static
39e4e62a0a0...18.exe
windows7-x64
79e4e62a0a0...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3config.dll
windows7-x64
5config.dll
windows10-2004-x64
5iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1lq.exe
windows7-x64
1lq.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 13:17
Static task
static1
Behavioral task
behavioral1
Sample
9e4e62a0a066ac3a251b823def1ce4b0_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9e4e62a0a066ac3a251b823def1ce4b0_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral13
Sample
config.dll
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
config.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral15
Sample
iconAnimate.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
iconAnimate.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
iconTips.exe
Resource
win7-20240508-en
Behavioral task
behavioral18
Sample
iconTips.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral19
Sample
lq.exe
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
lq.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
uninst.exe
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
uninst.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240426-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240419-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
General
-
Target
uninst.exe
-
Size
338KB
-
MD5
3c03aa0a11686e0413a7f56b861972eb
-
SHA1
d291d59d8dab8d1fd0c7873a529def7dd05cc0db
-
SHA256
e613cbdca52993e08c6acbc750536b808f0e88024887867dc6cadf12aa9e93b1
-
SHA512
d002b3c02d6a65f49cf4aeb9ffd5ba1d75b6c5c2d1a2e31d8378d3b83e7950b64c8fd94af817806b7ba9f7850b836ea6602b67364c26d17a87e6f1c496f6a829
-
SSDEEP
6144:E8LxBLC70uYGxH8Eq4HIWuGV2w1FpVd0RQJuFwNTGlg/kV:vC7ikm4HIoYw1zVaRQowNTKgMV
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
Au_.exepid process 4380 Au_.exe -
Executes dropped EXE 1 IoCs
Processes:
Au_.exepid process 4380 Au_.exe -
Loads dropped DLL 2 IoCs
Processes:
Au_.exepid process 4380 Au_.exe 4380 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
lq.exedescription ioc process File opened for modification \??\PhysicalDrive0 lq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe nsis_installer_1 C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
Processes:
Au_.exelq.exepid process 4380 Au_.exe 4380 Au_.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe 1468 lq.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
uninst.exeAu_.exedescription pid process target process PID 728 wrote to memory of 4380 728 uninst.exe Au_.exe PID 728 wrote to memory of 4380 728 uninst.exe Au_.exe PID 728 wrote to memory of 4380 728 uninst.exe Au_.exe PID 4380 wrote to memory of 1468 4380 Au_.exe lq.exe PID 4380 wrote to memory of 1468 4380 Au_.exe lq.exe PID 4380 wrote to memory of 1468 4380 Au_.exe lq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\lq.exe"C:\Users\Admin\AppData\Local\Temp\lq.exe" /uninstallsucc3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1468
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396B
MD5b6a477832c0b2970d35fa811dd137dc4
SHA19ba543be34bb54225f9110cd800db26283c56461
SHA256da1ecd9afbea03ad48769f3812be703b1f3f1c213401fded9afbbfd401814636
SHA5126c181827aad44b0773119230110c5e22fc2ca8790604b88312759e37cb66aa181e3deb3e94b91f7436e6dc7232e7a9f794cf8a7e6ceb5af5ccb32d2b62dece59
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
338KB
MD53c03aa0a11686e0413a7f56b861972eb
SHA1d291d59d8dab8d1fd0c7873a529def7dd05cc0db
SHA256e613cbdca52993e08c6acbc750536b808f0e88024887867dc6cadf12aa9e93b1
SHA512d002b3c02d6a65f49cf4aeb9ffd5ba1d75b6c5c2d1a2e31d8378d3b83e7950b64c8fd94af817806b7ba9f7850b836ea6602b67364c26d17a87e6f1c496f6a829