Overview
overview
7Static
static
3c03424595a...18.exe
windows7-x64
7c03424595a...18.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...ew.dll
windows7-x64
3$PLUGINSDI...ew.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...te.dll
windows7-x64
3$PLUGINSDI...te.dll
windows10-2004-x64
3$PLUGINSDI...nd.dll
windows7-x64
3$PLUGINSDI...nd.dll
windows10-2004-x64
3$PLUGINSDIR/stack.dll
windows7-x64
3$PLUGINSDIR/stack.dll
windows10-2004-x64
3RClean.exe
windows7-x64
6RClean.exe
windows10-2004-x64
6RCleanT.exe
windows7-x64
3RCleanT.exe
windows10-2004-x64
3Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...am.dll
windows7-x64
3$PLUGINSDI...am.dll
windows10-2004-x64
3$PLUGINSDI...ew.dll
windows7-x64
3$PLUGINSDI...ew.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3Analysis
-
max time kernel
139s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25/08/2024, 07:04
Static task
static1
Behavioral task
behavioral1
Sample
c03424595ab2bf4310e27fef69eb3254_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
c03424595ab2bf4310e27fef69eb3254_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240705-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/SelfDelete.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/processes_second.dll
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/processes_second.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/stack.dll
Resource
win7-20240729-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/stack.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
RClean.exe
Resource
win7-20240705-en
Behavioral task
behavioral20
Sample
RClean.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
RCleanT.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
RCleanT.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
Uninstall.exe
Resource
win7-20240704-en
Behavioral task
behavioral24
Sample
Uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/DLLWaitForKillProgram.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/DLLWebCount_new.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win7-20240704-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
General
-
Target
Uninstall.exe
-
Size
88KB
-
MD5
2d06f4000af9632594d69f771b24cc99
-
SHA1
dceaddf53206b8168386971ea0c0e2d3dfa1a4a7
-
SHA256
b89c51188eaabe830f78c8ae021f50b4a2962360d7bdd260e9b967ad91945dd0
-
SHA512
3c451cc8f72303920097235c5fb42229194450b95fbf57d8d391ee3412a77374c5d3cd53138335b50250e33a1c7c4fd200378dade7954b2500445e4b7631a95e
-
SSDEEP
1536:8pgpHzb9dZVX9fHMvG0D3XJZ5abZyNTXpUnax++HE63ttNESPA6C/0qC:KgXdZt9P6D3XJ3aELpIcE6rF60qC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1960 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 1960 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral24/files/0x000900000002345a-3.dat nsis_installer_1 behavioral24/files/0x000900000002345a-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3096 wrote to memory of 1960 3096 Uninstall.exe 84 PID 3096 wrote to memory of 1960 3096 Uninstall.exe 84 PID 3096 wrote to memory of 1960 3096 Uninstall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\Uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5eef9e469e8a30717974499f277d97e2a
SHA12d33c25984ebd9116beeb55cdde4c5c86c023e5d
SHA2561f35bb6728237483c779005fc227e69fef51b0bafd32d15855d483948a337078
SHA512d860132106a1c03dfa23f983b3c503f1216ac02f3d47833b96dfb333fb30bc8ab4d4fecd1f1f0a89f0c7f3586405461e2d53c26f282bb48970e549659b364b48
-
Filesize
568B
MD5833f9536c5ebdd4c970c0175ff09b6c1
SHA11806b134f0adbf477e04514a9a98ab50a3f16dae
SHA256dd5e7d5d9ece4e8a9ade529bf9a2bd6e7fa83a23c95034bebcdaacef8fa16e18
SHA512e75735ac4d4c3dcd9bc4f97a45116341d559fd12d55397c5422cb11e705279a99548b946499d3bdad747d9119457a699cb33a408a8d8bf69e47594ab83067f03
-
Filesize
581B
MD58454a0430d5fda6ce109e9310306fbaf
SHA131852633cd04d6dd2b8bfd84e9b8f74b68dbff76
SHA25604367b838e2ba83442276d68f88db368a4bdd37e16e586b0923b9ec87606bf6e
SHA512b5f196b69925c7268dda4c118a83aee781019f8c72429a108ce9c9a8a83edba1886c71a7dd830ce0cb3814fbe1e491ba6157409344ef645c7e40eb12503bf525
-
Filesize
88KB
MD52d06f4000af9632594d69f771b24cc99
SHA1dceaddf53206b8168386971ea0c0e2d3dfa1a4a7
SHA256b89c51188eaabe830f78c8ae021f50b4a2962360d7bdd260e9b967ad91945dd0
SHA5123c451cc8f72303920097235c5fb42229194450b95fbf57d8d391ee3412a77374c5d3cd53138335b50250e33a1c7c4fd200378dade7954b2500445e4b7631a95e