Overview
overview
7Static
static
38a8c1f154e...18.exe
windows7-x64
78a8c1f154e...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
317fh3inryg...fhh.js
windows7-x64
317fh3inryg...fhh.js
windows10-2004-x64
3clicktale.js
windows7-x64
3clicktale.js
windows10-2004-x64
3uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7Analysis
-
max time kernel
136s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03/11/2024, 08:33
Static task
static1
Behavioral task
behavioral1
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8a8c1f154ede520ba28ee23fa9039943_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
17fh3inrygzt66bkxyd45zwr8,4k2jxds8qtdo2192sqg4wnfhh.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
clicktale.js
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
clicktale.js
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
uninst.exe
Resource
win7-20241023-en
Behavioral task
behavioral12
Sample
uninst.exe
Resource
win10v2004-20241007-en
General
-
Target
uninst.exe
-
Size
49KB
-
MD5
3c4ec8bcade5ad54319c5653ec6aaad0
-
SHA1
24f92905906bddb333a5b3981755e82e0418eff1
-
SHA256
64865d010b7bd6190a7e49b9bdf43c69d7f1d965b2c1a48cbb5257727ee09112
-
SHA512
4fc345cc60c8c301201da1ac48a1a8d8c6bfd24c842fbae6b6d5e3c15a9bf67725206fbecafe8f8b3dbda2188df064cd3a81c7fe727477f38ff6796d3889c250
-
SSDEEP
1536:ijoUxZbE+HOI66qkryz9zIBgdLeAyNxKics/:idxNE+Hb+eyz9zIBceAZDs/
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2716 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 2716 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uninst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Au_.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2716 3040 uninst.exe 84 PID 3040 wrote to memory of 2716 3040 uninst.exe 84 PID 3040 wrote to memory of 2716 3040 uninst.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD53c4ec8bcade5ad54319c5653ec6aaad0
SHA124f92905906bddb333a5b3981755e82e0418eff1
SHA25664865d010b7bd6190a7e49b9bdf43c69d7f1d965b2c1a48cbb5257727ee09112
SHA5124fc345cc60c8c301201da1ac48a1a8d8c6bfd24c842fbae6b6d5e3c15a9bf67725206fbecafe8f8b3dbda2188df064cd3a81c7fe727477f38ff6796d3889c250