14b70f6df5d526508a2e5014ac72b079da51cad761f8aad8e65f42d4f9cefbf4 | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
226489cd9e0a8d712494080f2555d568_JaffaCakes118
Size 161KB
Sample240508-aq9ebabd95
SHA256 14b70f6df5d526508a2e5014ac72b079da51cad761f8aad8e65f42d4f9cefbf4
MD5 226489cd9e0a8d712494080f2555d568
SHA1 ced4fbb69b5715d3cc66b287f4bd5a756a9b57b7
SHA512 002108015f44f6b13e5cb6ad4ff2c64d9a47e55886c7c7210efa4c6d430db23eb094da8e2790bec9f866688011a2c7375337e22e48eda23c511c5ab3796623c2
SSDEEP 3072:XP2tnrk3mmJRwZUFGsb3EIIz82Kcwf8k4Djll6W1RM3eVYQI18G4o:XAzU0srENz5XwfX4D/6W1O3urG4o
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Targets

- Target
  226489cd9e0a8d712494080f2555d568_JaffaCakes118
- Size 161KB
- SHA256 14b70f6df5d526508a2e5014ac72b079da51cad761f8aad8e65f42d4f9cefbf4
- MD5 226489cd9e0a8d712494080f2555d568
- SHA1 ced4fbb69b5715d3cc66b287f4bd5a756a9b57b7
- SHA512 002108015f44f6b13e5cb6ad4ff2c64d9a47e55886c7c7210efa4c6d430db23eb094da8e2790bec9f866688011a2c7375337e22e48eda23c511c5ab3796623c2
- SSDEEP 3072:XP2tnrk3mmJRwZUFGsb3EIIz82Kcwf8k4Djll6W1RM3eVYQI18G4o:XAzU0srENz5XwfX4D/6W1O3urG4o
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 45de80c4ef75ac01fdfca02a0c05c090311cb65b0f52b61e2307494d643466df
- MD5 7191bf2f751c79e50386b87c458ed2da
- SHA1 30df71f1945f0ece8d396042dba84d92f84dbfb6
- SHA512 121143369c5edd732a513c884fa90d0ffc03f3966c46f8feccad09591295890de61dec7872e6fd6cd03ae132287bd1dad44d74b45fc8e623a0fa4a647510ca91
- SSDEEP 192:dlKA1Fiy+JjtWyPPW/O3w3hzwGRDvTR5QKZMAWSp2o0R:WA1n+HXoO38bVvTDZMAWSpuR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  DaumIEi.exe
- Size 149KB
- SHA256 bc5c7b32727576e6019db45b8cede274ccbe06f424af99824f0fbb7e25a72ef4
- MD5 baa4b1375177708369f61e9b97374ca8
- SHA1 6fd6fb143c3a27b69cf73a6a57ffed2e89442fc9
- SHA512 eed589970953931a294a00bf01e7ee6b6a95d69b1571a78eda5a5b2639b2cecf6402be1b7a039edf912d965d2677fdff3749745630a34a942ad681ee6d15aa9a
- SSDEEP 3072:4P2tnrk3mmJoU4HINLNuwBWR+Xu8vKYuie5R8AwYfDeillo4h4qH:4AAxNMwBHXlvBuLzwENlo4h4qH
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

discovery
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral5 behavioral6
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 7f3057abae7e8b5b91a35fbb23897657accb8c724e923d5d4a0e9208ca09c445
- MD5 de86f5220bcbbac420fc4f6166bb2d91
- SHA1 d0d52fdacbcffe0058cedfc20cf5108475033f5d
- SHA512 d22f7807037c410427518891dee5dd535361df514ce0980a654d99d32f369b5e9c2059bc5930d807e93ebb3b7741d09466dd87bb796256daf9d8a630280fbe99
- SSDEEP 192:mO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:DKAFERdlxhGRYUzqZaf
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/UAC.dll
- Size 13KB
- SHA256 45de80c4ef75ac01fdfca02a0c05c090311cb65b0f52b61e2307494d643466df
- MD5 7191bf2f751c79e50386b87c458ed2da
- SHA1 30df71f1945f0ece8d396042dba84d92f84dbfb6
- SHA512 121143369c5edd732a513c884fa90d0ffc03f3966c46f8feccad09591295890de61dec7872e6fd6cd03ae132287bd1dad44d74b45fc8e623a0fa4a647510ca91
- SSDEEP 192:dlKA1Fiy+JjtWyPPW/O3w3hzwGRDvTR5QKZMAWSp2o0R:WA1n+HXoO38bVvTDZMAWSpuR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  DaumBho2.dll
- Size 104KB
- SHA256 0d760f5b208519c61bb6538771112c784d90e9d10ff18cb64981c0a517d7160c
- MD5 9950c43d7c04d3a28c59dac554eb5c82
- SHA1 9950e3f976bf453f73d075c88499cdb0b14d2d8b
- SHA512 06deb798dbb2fbb558a5e82b89a05688eba57422e190897587747c4a93b5c89e43c940650796fdd3c277c747ccd812d7df78990170920806f18e0c72d9ccf902
- SSDEEP 1536:Y7F7BCGUJWeErh9XRyvpiufq9T8bWbw0WBK6tRW20wcXr:Y7sJBErh/lDgmw0kftcFX
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware stealer
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12
- Target
  DaumIEHistory.exe
- Size 52KB
- SHA256 6ff963ca8ae5bbc46ca2e3650e03bcf99347d606a2d37104cb69599ad2a18268
- MD5 339c43ad0a8f6bcb194dc641a21502ac
- SHA1 c761377c32af3ef39f1353e6938471121a679967
- SHA512 53bd8fe9d21574384d4ecaef10f5066252b83863344fd3371706e3df463e7ff23907f838736cd12082b01aff9d02cb6f65947045cfcebbc729fad889988ae3a0
- SSDEEP 768:LY6ouquF6bHndKjwhR0E8MG1YVhFnwoff+pEuF4tzv:LQNbHAjwhReDY/Fn5+Hqtzv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral13 behavioral14

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14