Overview
overview
7Static
static
31f40c4422f...18.exe
windows7-x64
71f40c4422f...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3iconAnimate.exe
windows7-x64
1iconAnimate.exe
windows10-2004-x64
1iconTips.exe
windows7-x64
1iconTips.exe
windows10-2004-x64
1uninst.exe
windows7-x64
7uninst.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3yj_dtsk.exe
windows7-x64
1yj_dtsk.exe
windows10-2004-x64
1Analysis
-
max time kernel
132s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
1f40c4422ffff18c554b7313d3a8df60_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1f40c4422ffff18c554b7313d3a8df60_JaffaCakes118.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral11
Sample
iconAnimate.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
iconAnimate.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral13
Sample
iconTips.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
iconTips.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral15
Sample
uninst.exe
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
uninst.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240220-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
Behavioral task
behavioral27
Sample
yj_dtsk.exe
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
yj_dtsk.exe
Resource
win10v2004-20240419-en
General
-
Target
uninst.exe
-
Size
289KB
-
MD5
62d59d949c8738764fb4e0c440fc0d3b
-
SHA1
cc0d44be6faa84393a3ce3e1e725a95d5a662ce4
-
SHA256
c9a35e11c82fe4df61b96a9c57b20bdd59a5903a67a59c6e9156d303450afc61
-
SHA512
1587f863992d1ab62029d033551f3d567c9716738dfc4ca90f6cf9f7a034925d9a019cee1fed839b51db7c187eaa230b79a8f47f2eb0d22232bbb9cf7347b9e5
-
SSDEEP
6144:Ie34RTXlHyCn4ik6yiUfFY2SzpYn2/gnqqjG:kTVFkJy2Sz6n2/
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 408 Au_.exe -
Executes dropped EXE 1 IoCs
pid Process 408 Au_.exe -
Loads dropped DLL 2 IoCs
pid Process 408 Au_.exe 408 Au_.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 yj_dtsk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral16/files/0x000b000000023b91-3.dat nsis_installer_1 behavioral16/files/0x000b000000023b91-3.dat nsis_installer_2 -
Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 408 Au_.exe 408 Au_.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe 1592 yj_dtsk.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4976 wrote to memory of 408 4976 uninst.exe 83 PID 4976 wrote to memory of 408 4976 uninst.exe 83 PID 4976 wrote to memory of 408 4976 uninst.exe 83 PID 408 wrote to memory of 1592 408 Au_.exe 96 PID 408 wrote to memory of 1592 408 Au_.exe 96 PID 408 wrote to memory of 1592 408 Au_.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\uninst.exe"C:\Users\Admin\AppData\Local\Temp\uninst.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\yj_dtsk.exe"C:\Users\Admin\AppData\Local\Temp\yj_dtsk.exe" /uninstallsucc3⤵
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:1592
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
439B
MD5c7619a63909ac7b1891cdef2c58eae86
SHA1e312edb9c470f43f869611cdcdcb3dd2e3d133f7
SHA256a9f4943ff41ee1db6024b3cc53a801898f16af32f5b6c1ab15e935aae86cf00e
SHA512a6bc53cab680017198a595e166a1eabe79d79b024c414d4c895a13e9ac0ff126383899fabeb30cc84e2fab0ed1e7e28e0e8c25b542fb850be03772210fb15667
-
Filesize
3KB
MD58614c450637267afacad1645e23ba24a
SHA1e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
SHA2560fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
SHA512af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
-
Filesize
20KB
MD5c498ae64b4971132bba676873978de1e
SHA192e4009cd776b6c8616d8bffade7668ef3cb3c27
SHA2565552bdde7e4113393f683ef501e4cc84dccc071bdc51391ea7fa3e7c1d49e4e8
SHA5128e5ca35493f749a39ceae6796d2658ba10f7d8d9ceca45bb4365b338fabd1dfa9b9f92e33f50c91b0273e66adfbce4b98b09c15fd2473f8b214ed797462333d7
-
Filesize
289KB
MD562d59d949c8738764fb4e0c440fc0d3b
SHA1cc0d44be6faa84393a3ce3e1e725a95d5a662ce4
SHA256c9a35e11c82fe4df61b96a9c57b20bdd59a5903a67a59c6e9156d303450afc61
SHA5121587f863992d1ab62029d033551f3d567c9716738dfc4ca90f6cf9f7a034925d9a019cee1fed839b51db7c187eaa230b79a8f47f2eb0d22232bbb9cf7347b9e5