Overview
overview
7Static
static
353141068f0...18.exe
windows7-x64
753141068f0...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...nu.dll
windows7-x64
3$PLUGINSDI...nu.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3MSS32.dll
windows7-x64
3MSS32.dll
windows10-2004-x64
3Oasis.exe
windows7-x64
3Oasis.exe
windows10-2004-x64
3aminstall.dll
windows7-x64
3aminstall.dll
windows10-2004-x64
3mssmp3.dll
windows7-x64
3mssmp3.dll
windows10-2004-x64
3readme.htm
windows7-x64
3readme.htm
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
53141068f04ebf4cd8e5e83219b6e8a4_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
53141068f04ebf4cd8e5e83219b6e8a4_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Dialer.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Dialer.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/StartMenu.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsisdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
MSS32.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
MSS32.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Oasis.exe
Resource
win7-20241010-en
Behavioral task
behavioral18
Sample
Oasis.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
aminstall.dll
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
aminstall.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
mssmp3.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
mssmp3.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
readme.htm
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
readme.htm
Resource
win10v2004-20241007-en
General
-
Target
Oasis.exe
-
Size
1.9MB
-
MD5
b02675b7e0e030af8ec0b5178ceb42a5
-
SHA1
cb4b4c6309b12722d347ac885f51a7432860465e
-
SHA256
9304914e0693be2e59dcbe7c8317aa6ce87040058b518451e3255851234108d3
-
SHA512
d16d7a445b3760f401ce0fead210b56c48bc90faa74fdbb16cfbd9322a63fa6dd544ddefc772add58d57d11b41c4d715d28fec461278800846303dbf877d80b4
-
SSDEEP
49152:lTX12/EHdn+7+8XnBSW4meQX4x5at0LdzYp3Im0g:N1tt+7+Kv4VxDLdw3H0g
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Oasis.exe -
Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe 4992 Oasis.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4992 Oasis.exe 4992 Oasis.exe