Overview
overview
7Static
static
338756ece95...18.exe
windows7-x64
738756ece95...18.exe
windows10-2004-x64
7$LOCALAPPD...er.exe
windows7-x64
7$LOCALAPPD...er.exe
windows10-2004-x64
7$PLUGINSDI...ll.dll
windows7-x64
1$PLUGINSDI...ll.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$LOCALAPPD...SA.exe
windows7-x64
6$LOCALAPPD...SA.exe
windows10-2004-x64
6$LOCALAPPD...CB.exe
windows7-x64
1$LOCALAPPD...CB.exe
windows10-2004-x64
1$LOCALAPPD...ok.dll
windows7-x64
1$LOCALAPPD...ok.dll
windows10-2004-x64
1$PLUGINSDI...ll.dll
windows7-x64
1$PLUGINSDI...ll.dll
windows10-2004-x64
1$PLUGINSDI...lp.dll
windows7-x64
1$PLUGINSDI...lp.dll
windows10-2004-x64
1$PLUGINSDIR/Setup.dll
windows7-x64
1$PLUGINSDIR/Setup.dll
windows10-2004-x64
1$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 08:51 UTC
Static task
static1
Behavioral task
behavioral1
Sample
38756ece952ccc136c5a3c94162b343f_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
38756ece952ccc136c5a3c94162b343f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/$OUTDIR/RavenBleuUninstaller.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/$OUTDIR/RavenBleuUninstaller.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Install.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Install.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral9
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSA.exe
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSA.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral11
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSACB.exe
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSACB.exe
Resource
win10v2004-20240704-en
Behavioral task
behavioral13
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSAHook.dll
Resource
win7-20240704-en
Behavioral task
behavioral14
Sample
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/RavenBleuSAHook.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/Install.dll
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/Install.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/LaunchHelp.dll
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/LaunchHelp.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/Setup.dll
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/Setup.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240709-en
General
-
Target
$LOCALAPPDATA/RavenBleuSA/bin/1.0.13.0/$OUTDIR/RavenBleuUninstaller.exe
-
Size
139KB
-
MD5
8158d8c4808cbb76e5e3f219df862297
-
SHA1
9614fc01763dab8cbb9cd93fb551343e52fcee2f
-
SHA256
d7a703bdc04486fef208e19880d4a5437d2e7dd983d3d722e897ac0e42a5ba4d
-
SHA512
b103e53f465d365c3cf17fdc395b3bc5c9173703dc40862c873f0081f2e422b72f5e7301b596145483d09ddeb13a855c415e5a1d45ebbe38cc08e1cd7d88e1dd
-
SSDEEP
3072:nQIURTXJHgueJef7JtOafRypSf3DKr8TStq8duqTe1rXrQX:nsCPG7J34pS2riStq1TxrQX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4820 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 4820 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral4/files/0x00070000000234da-3.dat nsis_installer_1 behavioral4/files/0x00070000000234da-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 804 wrote to memory of 4820 804 RavenBleuUninstaller.exe 85 PID 804 wrote to memory of 4820 804 RavenBleuUninstaller.exe 85 PID 804 wrote to memory of 4820 804 RavenBleuUninstaller.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\RavenBleuUninstaller.exe"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\RavenBleuUninstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\RavenBleuSA\bin\1.0.13.0\$OUTDIR\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4820
-
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.dual-a-0034.a-msedge.netg-bing-com.dual-a-0034.a-msedge.netIN CNAMEdual-a-0034.a-msedge.netdual-a-0034.a-msedge.netIN A13.107.21.237dual-a-0034.a-msedge.netIN A204.79.197.237
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=3E6AB3AC6E8260453199A7156F216155; domain=.bing.com; expires=Tue, 05-Aug-2025 08:51:46 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2CC6CBEABC01453380E087098E339F0C Ref B: AMS04EDGE1609 Ref C: 2024-07-11T08:51:46Z
date: Thu, 11 Jul 2024 08:51:46 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3E6AB3AC6E8260453199A7156F216155
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=mtcNCMp8rN7EVSqQ6ibdp1Wx0Zko9Tds0sGYGcM4mkw; domain=.bing.com; expires=Tue, 05-Aug-2025 08:51:46 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F8D4B0199084479A8140DB229506FCDE Ref B: AMS04EDGE1609 Ref C: 2024-07-11T08:51:46Z
date: Thu, 11 Jul 2024 08:51:46 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=Remote address:13.107.21.237:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=3E6AB3AC6E8260453199A7156F216155; MSPTC=mtcNCMp8rN7EVSqQ6ibdp1Wx0Zko9Tds0sGYGcM4mkw
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7CE8F270EE0248C5879D528610520B0C Ref B: AMS04EDGE1609 Ref C: 2024-07-11T08:51:46Z
date: Thu, 11 Jul 2024 08:51:46 GMT
-
Remote address:8.8.8.8:53Request73.31.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request237.21.107.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request55.36.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request157.123.68.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request38.58.20.217.in-addr.arpaIN PTRResponse
-
13.107.21.237:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=tls, http22.0kB 9.3kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=b0ce33cf2c0142d8aaa90ae3dda93360&localId=w:2199DD2E-A1D9-6377-4DC2-EDD793B3B417&deviceId=6825836757717110&anid=HTTP Response
204
-
56 B 151 B 1 1
DNS Request
g.bing.com
DNS Response
13.107.21.237204.79.197.237
-
71 B 157 B 1 1
DNS Request
73.31.126.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
237.21.107.13.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
55.36.223.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
157.123.68.40.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
71 B 131 B 1 1
DNS Request
38.58.20.217.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD57b915d6227d9f4dfe30b9f979f5976e7
SHA16157749d1e4432227d226457b247472f0b9697a8
SHA2564b74e01dc6fbdf0fad39e6e68a498dfa7708098a87d945ae0da1b8a20fb272cb
SHA5128f6b3e14a0f505eaf3be21dd1d0ca022e9006bf599d03f0d7cd54c61514b79236f2b3b7333107902b3d72c9ad2a7255b184137c9836b2d0d5ce3ef4459461a88
-
Filesize
139KB
MD58158d8c4808cbb76e5e3f219df862297
SHA19614fc01763dab8cbb9cd93fb551343e52fcee2f
SHA256d7a703bdc04486fef208e19880d4a5437d2e7dd983d3d722e897ac0e42a5ba4d
SHA512b103e53f465d365c3cf17fdc395b3bc5c9173703dc40862c873f0081f2e422b72f5e7301b596145483d09ddeb13a855c415e5a1d45ebbe38cc08e1cd7d88e1dd