Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3763e370d93...18.exe
windows7-x64
7763e370d93...18.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3ffTrustMed...ion.js
windows7-x64
3ffTrustMed...ion.js
windows10-2004-x64
3ff/chrome/...139.js
windows7-x64
3ff/chrome/...139.js
windows10-2004-x64
3ff/chrome/...ion.js
windows7-x64
3ff/chrome/...ion.js
windows10-2004-x64
3ie/TrustMe...39.dll
windows7-x64
6ie/TrustMe...39.dll
windows10-2004-x64
6ie/TrustMe...64.dll
windows7-x64
7ie/TrustMe...64.dll
windows10-2004-x64
7uninstall.exe
windows7-x64
7uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27/10/2024, 22:23
Static task
static1
Behavioral task
behavioral1
Sample
763e370d93391ed70d3e7fd2cf74e476_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
763e370d93391ed70d3e7fd2cf74e476_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
ffTrustMediaViewerV1alpha6139chaction.js
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
ffTrustMediaViewerV1alpha6139chaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6139.js
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6139.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6139ffaction.js
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
ff/chrome/content/ffTrustMediaViewerV1alpha6139ffaction.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
ie/TrustMediaViewerV1alpha6139.dll
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
ie/TrustMediaViewerV1alpha6139.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
ie/TrustMediaViewerV1alpha6139x64.dll
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
ie/TrustMediaViewerV1alpha6139x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
uninstall.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
uninstall.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/aminsis.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/aminsis.dll
Resource
win10v2004-20241007-en
General
-
Target
uninstall.exe
-
Size
295KB
-
MD5
8ef2ee0bd9eb868dee5a7c7f2de749bc
-
SHA1
c5657bffd61edf7b1d36a225ffc3dbf44d8f2f32
-
SHA256
ce885aa22707ec497138942e7f006c9bfd00fa330189fefc7cd1e4a2ae0f4cc4
-
SHA512
856060d36cda5fcbfc0e4df9f7676986ef1e72256b863fad2f5fff7e996bd166cfd7c7f87e3a3a85d4d3e04ae9b856088341ec46885b4d4e3440123e5879cb75
-
SSDEEP
6144:Ee34VyjKTK0HVkUEYA2q5NbrWN83gQwwDuzMn6yDkvE39kojTxDtEY:QyjeKuVnvon+N83LwwiAn6KkM33nxDR
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4776 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 4776 Au_.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninstall.exe -
NSIS installer 2 IoCs
resource yara_rule behavioral18/files/0x0007000000023cab-3.dat nsis_installer_1 behavioral18/files/0x0007000000023cab-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 836 wrote to memory of 4776 836 uninstall.exe 84 PID 836 wrote to memory of 4776 836 uninstall.exe 84 PID 836 wrote to memory of 4776 836 uninstall.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninstall.exe"C:\Users\Admin\AppData\Local\Temp\uninstall.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
567KB
MD5f346047b13f37f79c462e59a6319faa1
SHA1ce9e7cb9719000a69b463fe024c81229e322279f
SHA256e78e0e61707cabec8383f1e74da9db8e0fa123a3a7b36f0080d70fbaed6f7453
SHA512429209cc489ba9ac2d62055b128efb3cded3e31f966c7cdb1aee592ec7a54ab090526705fa2519498d92eb4bc2efa141cd83adc6c251b793388ad1208b172167
-
Filesize
295KB
MD58ef2ee0bd9eb868dee5a7c7f2de749bc
SHA1c5657bffd61edf7b1d36a225ffc3dbf44d8f2f32
SHA256ce885aa22707ec497138942e7f006c9bfd00fa330189fefc7cd1e4a2ae0f4cc4
SHA512856060d36cda5fcbfc0e4df9f7676986ef1e72256b863fad2f5fff7e996bd166cfd7c7f87e3a3a85d4d3e04ae9b856088341ec46885b4d4e3440123e5879cb75