Overview
overview
7Static
static
73003efe284...18.exe
windows7-x64
73003efe284...18.exe
windows10-2004-x64
7$PLUGINSDI...rt.dll
windows7-x64
3$PLUGINSDI...rt.dll
windows10-2004-x64
3$PLUGINSDI...nt.dll
windows7-x64
3$PLUGINSDI...nt.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...on.dll
windows7-x64
3$PLUGINSDI...on.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDIR/Math.dll
windows7-x64
3$PLUGINSDIR/Math.dll
windows10-2004-x64
3$PLUGINSDI...er.exe
windows7-x64
3$PLUGINSDI...er.exe
windows10-2004-x64
3$_2_/Uninstall.exe
windows7-x64
7$_2_/Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ut.dll
windows7-x64
3$PLUGINSDI...ut.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows7-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDIR/ef.exe
windows7-x64
3$PLUGINSDIR/ef.exe
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3Analysis
-
max time kernel
110s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 13:05
Behavioral task
behavioral1
Sample
3003efe2840cf07e1bf83d562bbec442_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3003efe2840cf07e1bf83d562bbec442_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/BaseConvert.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/BaseConvert.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ButtonEvent.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/GetVersion.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Linker.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Linker.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/Math.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/Math.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/SimpleInstaller.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/SimpleInstaller.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$_2_/Uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$_2_/Uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/ThreadTimer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/Timeout.dll
Resource
win7-20241010-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/Timeout.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/blowfish.dll
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/blowfish.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/ef.exe
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/ef.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20241007-en
General
-
Target
$_2_/Uninstall.exe
-
Size
42KB
-
MD5
9787542432e07524484183fd2fa1a080
-
SHA1
77daa1bf84000621fd3929eb44b1069794c53b3b
-
SHA256
e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9
-
SHA512
66f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e
-
SSDEEP
768:/4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJDJRnhzwr:gLXB65939tY6HBg4sXJk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1260 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral20/files/0x0007000000023cb6-3.dat nsis_installer_1 behavioral20/files/0x0007000000023cb6-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3904 wrote to memory of 1260 3904 Uninstall.exe 84 PID 3904 wrote to memory of 1260 3904 Uninstall.exe 84 PID 3904 wrote to memory of 1260 3904 Uninstall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$_2_\Uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$_2_\2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1260
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD59787542432e07524484183fd2fa1a080
SHA177daa1bf84000621fd3929eb44b1069794c53b3b
SHA256e82cd4233a273f9eab2e89302023f690c0b0b1cb7d11861c5dd98547b01b53f9
SHA51266f04867a0d6c7c88f21c0a400673a3e1b6a08fcab3036bc937b322b81d519e4e555cc628b6be5d2cbc76d8c97b4c95157bfb6c37163a540b2b474d1c003276e