Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
30977b29114...18.exe
windows7-x64
70977b29114...18.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffRichMedi...ion.js
windows7-x64
3ffRichMedi...ion.js
windows10-2004-x64
3ff/chrome/...005.js
windows7-x64
3ff/chrome/...005.js
windows10-2004-x64
ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/RichMed...05.dll
windows7-x64
6ie/RichMed...05.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
11s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
0977b291147568ba35b7b03fb04ac2bf_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0977b291147568ba35b7b03fb04ac2bf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
ffRichMediaViewV1release1005chaction.js
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
ffRichMediaViewV1release1005chaction.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffRichMediaViewV1release1005.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffRichMediaViewV1release1005.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffRichMediaViewV1release1005ffaction.js
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffRichMediaViewV1release1005ffaction.js
Resource
win10v2004-20240910-en
Behavioral task
behavioral11
Sample
ie/RichMediaViewV1release1005.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ie/RichMediaViewV1release1005.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20240802-en
General
-
Target
uninstall.exe
-
Size
289KB
-
MD5
cceb3a3b9dbfed85bb656f2be7d8f16d
-
SHA1
8aadc169015c9a38f06d9d2aad51005a0c3c5d9c
-
SHA256
dcb24a0e6e823dde6add4d3e8019ee33c9d38c457291aff860cd350e585251a5
-
SHA512
ffb9ab7a133254af9eeb56a0e98fdab52a6f6ce831d8669b2613ffe9b8a12ed20064d630ff3ada771ea909fb4d4c824539882728149b55c69145751f38c13b7e
-
SSDEEP
6144:Ue34RzRg4l8ai5PQtTZ763J8eWW43YLYjn5uO7D32fuCa7BmC:Uzq4OaQQTYJ8eP4/L5uO7D3f5BT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2480 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 1120 uninstall.exe 2480 Au_.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral13/files/0x000d000000018b64-2.dat nsis_installer_1 behavioral13/files/0x000d000000018b64-2.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2480 1120 uninstall.exe 29 PID 1120 wrote to memory of 2480 1120 uninstall.exe 29 PID 1120 wrote to memory of 2480 1120 uninstall.exe 29 PID 1120 wrote to memory of 2480 1120 uninstall.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
567KB
MD5450753ad96785a240a39deccab3af0d0
SHA121c544064d2ffa6444508268ce258a330d459fc5
SHA2561c371dcc6c3428ea98fb0d2dcb612b4ebc731f3ed72e683c8e33058cd2a952d3
SHA512c41b834f4228b7668316095569c836b4e0d55c5fbf310c65b0e0453ef0e74a3ce8f9357cea90b80f6590f85dd7708eeb4eec27518811ea4aab20c0e7f5643dab
-
Filesize
289KB
MD5cceb3a3b9dbfed85bb656f2be7d8f16d
SHA18aadc169015c9a38f06d9d2aad51005a0c3c5d9c
SHA256dcb24a0e6e823dde6add4d3e8019ee33c9d38c457291aff860cd350e585251a5
SHA512ffb9ab7a133254af9eeb56a0e98fdab52a6f6ce831d8669b2613ffe9b8a12ed20064d630ff3ada771ea909fb4d4c824539882728149b55c69145751f38c13b7e