Overview
overview
7Static
static
325c4ae65e0...18.exe
windows7-x64
725c4ae65e0...18.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffMediaWat...ion.js
windows7-x64
3ffMediaWat...ion.js
windows10-2004-x64
3ff/chrome/...436.js
windows7-x64
3ff/chrome/...436.js
windows10-2004-x64
3ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/MediaWa...36.dll
windows7-x64
6ie/MediaWa...36.dll
windows10-2004-x64
6uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
93s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08-10-2024 21:34
Static task
static1
Behavioral task
behavioral1
Sample
25c4ae65e08b895279d287fa70cd0a53_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
25c4ae65e08b895279d287fa70cd0a53_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
ffMediaWatchV1home436chaction.js
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
ffMediaWatchV1home436chaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
ff/chrome/content/ffMediaWatchV1home436.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ff/chrome/content/ffMediaWatchV1home436.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffMediaWatchV1home436ffaction.js
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffMediaWatchV1home436ffaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ie/MediaWatchV1home436.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ie/MediaWatchV1home436.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
General
-
Target
uninstall.exe
-
Size
285KB
-
MD5
ce0c9927fd75ded7112843370bd6e87b
-
SHA1
7b60db758c8722bb9a599a7726bbf1c8d9ac0651
-
SHA256
2f63bcfaee8fd6f0da5d6ddd43911a861f1f32b63ca867769de6676ab58138de
-
SHA512
81c5180c718478bb657c27e105ed55dbc036ae1f7993a8b90567642f3b95e7b449b5f14316e1ee34f5cd65e777e94e4ca5567423b107f85207792116cfafe79a
-
SSDEEP
6144:Ee34MxrpeZH+zpyuuz6GZkDOJ/7OafSH5KmrWym09x1e:p3eZHkwuPikQ7lKH5p5H9x1e
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3960 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 3960 Au_.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral14/files/0x0031000000023b7b-3.dat nsis_installer_1 behavioral14/files/0x0031000000023b7b-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3928 wrote to memory of 3960 3928 uninstall.exe 84 PID 3928 wrote to memory of 3960 3928 uninstall.exe 84 PID 3928 wrote to memory of 3960 3928 uninstall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3960
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
559KB
MD551ba1095f0ae45a2d444bea506cb9ad4
SHA1038a5d53d055a6d440bd2c8864c2f51db206c5e5
SHA256b620091bf9973e807e12155d2247a6d233b5d13ec38c426675470ab4b26f0539
SHA512f5fe2dd0f19bcaab47540ceedbec71f7f7c5b833c8772c097594c458e5f1101fe9feb849812b65c175055f71dfb13f11c4ad94fef42cd66f247413e453de3361
-
Filesize
285KB
MD5ce0c9927fd75ded7112843370bd6e87b
SHA17b60db758c8722bb9a599a7726bbf1c8d9ac0651
SHA2562f63bcfaee8fd6f0da5d6ddd43911a861f1f32b63ca867769de6676ab58138de
SHA51281c5180c718478bb657c27e105ed55dbc036ae1f7993a8b90567642f3b95e7b449b5f14316e1ee34f5cd65e777e94e4ca5567423b107f85207792116cfafe79a