Overview
overview
7Static
static
33b01f0db9c...18.exe
windows7-x64
73b01f0db9c...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Inetc.dll
windows7-x64
3$PLUGINSDIR/Inetc.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3ffdy.exe
windows7-x64
3ffdy.exe
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDIR/Inetc.dll
windows7-x64
3$PLUGINSDIR/Inetc.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 16:31
Static task
static1
Behavioral task
behavioral1
Sample
3b01f0db9c9e9476dd4b225a64fec053_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3b01f0db9c9e9476dd4b225a64fec053_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/Inetc.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/Inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ffdy.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ffdy.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
uninst.exe
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
uninst.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Inetc.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Inetc.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
uninst.exe
-
Size
148KB
-
MD5
45b585b3bf294177af776ad51a75a03a
-
SHA1
c2db4025458aa550436a6fb3a7db46ec96f7c62a
-
SHA256
9aacb086deead7752675939f0b3cf914bc4cab77ee778fc0d8a0dfe0f33cb746
-
SHA512
71968b0657aad1d5658a57ece4c54887ff4539b0277be1dbc241abeb5b6c1d2fe0fe35d2e87a8ea2de26739bb43d4bbd48985e818ab7d39e4947c7e50e6c513f
-
SSDEEP
1536:wf4exGDkeZ4mOoSgJEAJJF4Fjf6uZFHd6Fuv1sE6NO1uWF8:O4eYZ4+1JXJJOFjf6uZ6Fuv1shOZF8
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1476 Au_.exe -
Loads dropped DLL 11 IoCs
pid Process 2740 uninst.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral13/files/0x000500000001a472-2.dat nsis_installer_1 behavioral13/files/0x000500000001a472-2.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe 1476 Au_.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1476 Au_.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30 PID 2740 wrote to memory of 1476 2740 uninst.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:1476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
148KB
MD545b585b3bf294177af776ad51a75a03a
SHA1c2db4025458aa550436a6fb3a7db46ec96f7c62a
SHA2569aacb086deead7752675939f0b3cf914bc4cab77ee778fc0d8a0dfe0f33cb746
SHA51271968b0657aad1d5658a57ece4c54887ff4539b0277be1dbc241abeb5b6c1d2fe0fe35d2e87a8ea2de26739bb43d4bbd48985e818ab7d39e4947c7e50e6c513f