Overview
overview
7Static
static
3226489cd9e...18.exe
windows7-x64
7226489cd9e...18.exe
windows10-2004-x64
7$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3DaumIEi.exe
windows7-x64
7DaumIEi.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3DaumBho2.dll
windows7-x64
6DaumBho2.dll
windows10-2004-x64
6DaumIEHistory.exe
windows7-x64
1DaumIEHistory.exe
windows10-2004-x64
1Analysis
- max time kernel
119s - max time network
120s - platform
windows7_x64 - resource
win7-20240220-en - resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system - submitted
08/05/2024, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral2
Sample
226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
DaumIEi.exe
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
DaumIEi.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
DaumBho2.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral12
Sample
DaumBho2.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
DaumIEHistory.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral14
Sample
DaumIEHistory.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
General
- Target 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe
- Size 161KB
- Sample240508-aq9ebabd95
- SHA256 14b70f6df5d526508a2e5014ac72b079da51cad761f8aad8e65f42d4f9cefbf4
- MD5 226489cd9e0a8d712494080f2555d568
- SHA1 ced4fbb69b5715d3cc66b287f4bd5a756a9b57b7
- SHA512 002108015f44f6b13e5cb6ad4ff2c64d9a47e55886c7c7210efa4c6d430db23eb094da8e2790bec9f866688011a2c7375337e22e48eda23c511c5ab3796623c2
- SSDEEP 3072:XP2tnrk3mmJRwZUFGsb3EIIz82Kcwf8k4Djll6W1RM3eVYQI18G4o:XAzU0srENz5XwfX4D/6W1O3urG4o
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1276 DaumIEi.exe - Loads dropped DLL 7 IoCs
pid Process 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 1276 DaumIEi.exe 1276 DaumIEi.exe 1276 DaumIEi.exe 1276 DaumIEi.exe 1276 DaumIEi.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files (x86)\Daum\DaumIE\DaumIEi.exe 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\DaumIEi.exe 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe File created C:\Program Files (x86)\Daum\DaumIE\DaumIEHistory.exe DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\DaumShortcut.reg DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE DaumIEi.exe File created C:\Program Files (x86)\Daum\DaumIE\DaumShortcut.reg DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\DaumIEHistory.exe DaumIEi.exe File created C:\Program Files (x86)\Daum\DaumIE\Uninstall.exe DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\RemoveIEShortcut.reg DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\option.dat DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe File created C:\Program Files (x86)\Daum\DaumIE\DaumBho2.dll DaumIEi.exe File created C:\Program Files (x86)\Daum\DaumIE\RemoveIEShortcut.reg DaumIEi.exe File created C:\Program Files (x86)\Daum\DaumIE\CreateIEShortcut.reg DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\DaumBho2.dll DaumIEi.exe File opened for modification C:\Program Files (x86)\Daum\DaumIE\CreateIEShortcut.reg DaumIEi.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- NSIS installer 2 IoCs
resource yara_rule behavioral1/files/0x00070000000163eb-10.dat nsis_installer_1 behavioral1/files/0x0006000000016e56-40.dat nsis_installer_1 - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2064 wrote to memory of 1276 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 28 PID 2064 wrote to memory of 1276 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 28 PID 2064 wrote to memory of 1276 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 28 PID 2064 wrote to memory of 1276 2064 226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\226489cd9e0a8d712494080f2555d568_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Program Files (x86)\Daum\DaumIE\DaumIEi.exe"C:\Program Files (x86)\Daum\DaumIE\DaumIEi.exe" $Params2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Daum\DaumIE\DaumIEi.exe
- Size 149KB
- SHA256 bc5c7b32727576e6019db45b8cede274ccbe06f424af99824f0fbb7e25a72ef4
- MD5 baa4b1375177708369f61e9b97374ca8
- SHA1 6fd6fb143c3a27b69cf73a6a57ffed2e89442fc9
- SHA512 eed589970953931a294a00bf01e7ee6b6a95d69b1571a78eda5a5b2639b2cecf6402be1b7a039edf912d965d2677fdff3749745630a34a942ad681ee6d15aa9a
- SSDEEP 3072:4P2tnrk3mmJoU4HINLNuwBWR+Xu8vKYuie5R8AwYfDeillo4h4qH:4AAxNMwBHXlvBuLzwENlo4h4qH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Daum\DaumIE\Uninstall.exe
- Size 59KB
- SHA256 696514ef74eb5b096afd576f577bc1a03d384f7584217c8fa7fe5a4b7babf5d0
- MD5 7e5d61f8a25abcafae90a4b0f8e2c943
- SHA1 cfd6cfd32fa17d7cc1c8f7f98c4291d77543afa9
- SHA512 15aa036eeca346290fd8ca7af5b937af25643fb07b5986ee4b19c80355994d783d269f35af9d87653d86a1199c32c81ddce9e5e0bcc93b79e885d647cf937f85
- SSDEEP 1536:4yQBynRvnrk3mmJoqAELVig3odXoOf44pr:4P2tnrk3mmJXAI0z4qt
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nso26E3.tmp\UAC.dll
- Size 13KB
- SHA256 45de80c4ef75ac01fdfca02a0c05c090311cb65b0f52b61e2307494d643466df
- MD5 7191bf2f751c79e50386b87c458ed2da
- SHA1 30df71f1945f0ece8d396042dba84d92f84dbfb6
- SHA512 121143369c5edd732a513c884fa90d0ffc03f3966c46f8feccad09591295890de61dec7872e6fd6cd03ae132287bd1dad44d74b45fc8e623a0fa4a647510ca91
- SSDEEP 192:dlKA1Fiy+JjtWyPPW/O3w3hzwGRDvTR5QKZMAWSp2o0R:WA1n+HXoO38bVvTDZMAWSpuR
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\nsy2721.tmp\System.dll
- Size 10KB
- SHA256 7f3057abae7e8b5b91a35fbb23897657accb8c724e923d5d4a0e9208ca09c445
- MD5 de86f5220bcbbac420fc4f6166bb2d91
- SHA1 d0d52fdacbcffe0058cedfc20cf5108475033f5d
- SHA512 d22f7807037c410427518891dee5dd535361df514ce0980a654d99d32f369b5e9c2059bc5930d807e93ebb3b7741d09466dd87bb796256daf9d8a630280fbe99
- SSDEEP 192:mO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1afgMO:DKAFERdlxhGRYUzqZaf
- MD5 SHA1 SHA512 SSDEEP