Overview
overview
7Static
static
3552ccebe1c...18.exe
windows7-x64
7552ccebe1c...18.exe
windows10-2004-x64
7$0/uninstall.exe
windows7-x64
7$0/uninstall.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$0/zwankysearch.dll
windows7-x64
1$0/zwankysearch.dll
windows10-2004-x64
1$0/zwankysearch.exe
windows7-x64
3$0/zwankysearch.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18/10/2024, 03:14
Static task
static1
Behavioral task
behavioral1
Sample
552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
552ccebe1ceb972e667a506d15305095_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$0/uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$0/uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$0/zwankysearch.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$0/zwankysearch.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$0/zwankysearch.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
$0/zwankysearch.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
$0/uninstall.exe
-
Size
78KB
-
MD5
490071c63a8583c44546421214809399
-
SHA1
f2268f3629b25b73b7f3ad984d867be01c19a670
-
SHA256
8f75ba9703c28b460025e05615222ed2b31e5eed829bfbab30bb029e873c0c24
-
SHA512
00301e21a10071a875b41ab8dbb715fad81af1c28f2badc8d2580b7b40ef52315fbd4af5e1e9a33c2070c3dc5c818632f0bed98f6e46d0869a3859997e12425b
-
SSDEEP
1536:PEkjY1zy214Qay0DGkJ7qAELVigJGo5hcpw/1q792sX7Ia12/DY:8kjAJ4dDGkJ+AI0bo1qRka0/U
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 980 Au_.exe -
Loads dropped DLL 3 IoCs
pid Process 980 Au_.exe 980 Au_.exe 980 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
NSIS installer 1 IoCs
resource yara_rule behavioral4/files/0x000d000000023b6d-3.dat nsis_installer_1 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3024 wrote to memory of 980 3024 uninstall.exe 84 PID 3024 wrote to memory of 980 3024 uninstall.exe 84 PID 3024 wrote to memory of 980 3024 uninstall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\$0\uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$0\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5d765c492c21689e3d9d61634371fd861
SHA1ac200933671ae52c9d5544d0e2e8e9144d286c83
SHA256551e6042dd494ea01549555ffc194ab9729da09058ec714eb368dd06642c9bbc
SHA5129919a9e848c8f1e26c75d0d29207571e4b86a4140bd554743d2c1f8bd7f386fe4919345b163d89a5d907fb165e435ba0ac5f6b1101713636141f156a420e2e0f
-
Filesize
10KB
MD5fe24766ba314f620d57d0cf7339103c0
SHA18641545f03f03ff07485d6ec4d7b41cbb898c269
SHA256802ef71440f662f456bed6283a5ff78066af016897fe6bfd29cac6edc2967bbd
SHA51260d36959895cebf29c4e7713e6d414980139c7aa4ed1c8c96fefb672c1263af0ce909fb409534355895649c0e8056635112efb0da2ba05694446aec2ca77e2e3
-
Filesize
703B
MD5524912a0e6d6a54b9594f10b878b2d9e
SHA1ce365aba889c75732c82a8901f1f7c32e8fbd8ef
SHA256a1c9f078deea99c95cd996e3460cdccaad10b911b0a8f8edd2f7c1dce1d3acdc
SHA5129439989d04911deee0b1b9f95e89b711a0e50ef320a7731d53db710ef79c0a579a20a9c4f7c587c64c85473586e7b8b0a6c2a40523d45ef3728aa12ab45ac6af
-
Filesize
628B
MD56f63f5e1a1e02cc323b13cc799264fa2
SHA116e4f87f9f3b19f590b36869df566af1648ce295
SHA25672a634c2db63507d110e1c6f2c7af7b395b6ce81a6e873d56a3e241cb7ba759b
SHA51235580ed54a0e54c63c17efab834b76ae4e276d8989b34209bc6deebcbf7728edc424a1c69844e508e24303d3dd80413c874ccafd5371fb0506c94c2818767088
-
Filesize
78KB
MD5490071c63a8583c44546421214809399
SHA1f2268f3629b25b73b7f3ad984d867be01c19a670
SHA2568f75ba9703c28b460025e05615222ed2b31e5eed829bfbab30bb029e873c0c24
SHA51200301e21a10071a875b41ab8dbb715fad81af1c28f2badc8d2580b7b40ef52315fbd4af5e1e9a33c2070c3dc5c818632f0bed98f6e46d0869a3859997e12425b