Overview
overview
7Static
static
396b4efb322...18.exe
windows7-x64
796b4efb322...18.exe
windows10-2004-x64
7$0/questresult.dll
windows7-x64
1$0/questresult.dll
windows10-2004-x64
1$0/questresult.exe
windows7-x64
1$0/questresult.exe
windows10-2004-x64
3$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 16:01
Static task
static1
Behavioral task
behavioral1
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
96b4efb322e9f719e9da043e26a2bd97_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$0/questresult.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$0/questresult.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$0/questresult.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$0/questresult.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$0/uninstall.exe
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$0/uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
General
-
Target
$0/uninstall.exe
-
Size
83KB
-
MD5
b8581e4563421179a21eb5f9daff2380
-
SHA1
99531598663bfaf0acd2e656532d9df44a69e4f3
-
SHA256
79334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23
-
SHA512
800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33
-
SSDEEP
1536:6EkjY1zy214Qay0DGkJ7qAELVigJU4cp9iCxVF97d2/D8q:BkjAJ4dDGkJ+AI0bxvxVDQ/F
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2436 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 2500 uninstall.exe 2436 Au_.exe 2436 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral7/files/0x0007000000016d71-2.dat nsis_installer_1 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2436 Au_.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2500 wrote to memory of 2436 2500 uninstall.exe 30 PID 2500 wrote to memory of 2436 2500 uninstall.exe 30 PID 2500 wrote to memory of 2436 2500 uninstall.exe 30 PID 2500 wrote to memory of 2436 2500 uninstall.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
736B
MD5c8db75538ba2c4824e2313e3cdf8d06a
SHA1df2fec0cce9c86112b588dc705efc565c105bc30
SHA256b10014bd315900946e134d7086985272b4c4c360c94868fe49e8fb312f80bcf0
SHA5122a8e8ff7faf1955c1113d82943df6cb326f6a8afc5d4b82bac2138f888e0036d8bb17bc9986635a17aa4016002ccaf53d7c213166819d819ef896487102469bb
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
83KB
MD5b8581e4563421179a21eb5f9daff2380
SHA199531598663bfaf0acd2e656532d9df44a69e4f3
SHA25679334466126d6e4bf47b1964675c01885a9dbf27541fd72e72aae58f95acfd23
SHA512800e36eeff74e6e0a03d2cb75c71a9460c6fa1cbcc7457301996e20f1e578cf0cf9cba66de8e964bedf0f4a188bd954dc4799c0a87e4d2cea76b8b8e4b92cb33