78ca941981136f8de181216770bc32154be849c0d172314744f96c0ce8df9ed1

Sharing

Copy URL Twitter E-mail

General

Target
bd0ecf36f7d24bbbb772fea073093fa7_JaffaCakes118
Size 15.7MB
Sample240404-tysw3sda98
SHA256 78ca941981136f8de181216770bc32154be849c0d172314744f96c0ce8df9ed1
MD5 bd0ecf36f7d24bbbb772fea073093fa7
SHA1 6cf9922e01bea949a542369b912da6547a87f1f8
SHA512 5ef2cded0f6b032d2a2807e1567b20d0683b8d01f5acecac8c94fc95165b3b850d234d9d7d5235f5d92fda655fb028e24102adadd2d6aa674f871ec9b2f1ac04
SSDEEP 393216:DgSoLYCSMS2VO14A74NOivZ6+fgbEUinQDkgSd:kSoLozMO1jqAjiISd
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

bootkit persistence

Malware Config

Targets

- Target
  bd0ecf36f7d24bbbb772fea073093fa7_JaffaCakes118
- Size 15.7MB
- SHA256 78ca941981136f8de181216770bc32154be849c0d172314744f96c0ce8df9ed1
- MD5 bd0ecf36f7d24bbbb772fea073093fa7
- SHA1 6cf9922e01bea949a542369b912da6547a87f1f8
- SHA512 5ef2cded0f6b032d2a2807e1567b20d0683b8d01f5acecac8c94fc95165b3b850d234d9d7d5235f5d92fda655fb028e24102adadd2d6aa674f871ec9b2f1ac04
- SSDEEP 393216:DgSoLYCSMS2VO14A74NOivZ6+fgbEUinQDkgSd:kSoLozMO1jqAjiISd
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral1 behavioral2
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 15KB
- SHA256 f530069ef87a1c163c4fd63a3d5b053420ce3d7a98739c70211b4a99f90d6277
- MD5 89351a0a6a89519c86c5531e20dab9ea
- SHA1 9e801aaaae9e70d8f7fc52f6f12cedc55e4c8a00
- SHA512 13168fa828b581383e5f64d3b54be357e98d2eb9362b45685e7426ffc2f0696ab432cc8a3f374ce8abd03c096f1662d954877afa886fc4aa74709e6044b75c08
- SSDEEP 384:/MnT0MKT/Xwr2izZQ86mpAT8F9lN8Ov0J:EQMKzwTFnVX8i0
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/NSISPlugin.dll
- Size 1.0MB
- SHA256 f2b73ba3ca42dd9097727f6e0aabfa63b566c2d78be0d41791d72c6d16240d78
- MD5 362eddf4162293770bcff8fa9bfabb7f
- SHA1 aa80ab76aac054e6c3ebb2487ce396f92e97dc21
- SHA512 cbf4ba93afb6a9d6ac0a6a1cfef473d163b59e7737bb644e358ec6107a4730bd0cadfba6b8baeb2a597a8af90d5c861f6441b3d4f78873a06a82872af14a2e36
- SSDEEP 24576:Ix8E92oL6HJRtUj9xcSI338TzMQyK/O0:8H28BPYcTAQyKX
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/NSISPlugin_JApply.dll
- Size 1.0MB
- SHA256 92e9ed1b41664c0c1a4a01e71e948ee8f1c83b89128eae10cd000eec8218f453
- MD5 a405afddf84d2d5ea445f67b500c3ef8
- SHA1 1c93e082a52fa77190fd040f218ecab3e9d8f72a
- SHA512 ae8fa9ff11e6580717ddcfaee78daea706b93248fb667a3199dbec8ccb63ca5321ccf1e867ec34f01c412cfd6d5c30d1116c3b28e0be75e560ab0b13ad098d98
- SSDEEP 24576:dxqrmrclm8UDYF3mG2OjBjARt06TJwtBvSgoTjvQyKYT:0TmG2q6tAOTrQyK
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
- MD5 bf712f32249029466fa86756f5546950
- SHA1 75ac4dc4808ac148ddd78f6b89a51afbd4091c2e
- SHA512 13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
- SSDEEP 192:0N2gQuUwXzioj4KALV2upWzVd7q1QDXEbBZ8KxHdGzyS/Kx:rJoiO8V2upW7vQjS/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  TCLSCOPY/TenProtect/SecureCheck.dll
- Size 2.0MB
- SHA256 ecc02c355886331aefc098cfbd29c88b89bb4773d5752061debf63dd80cceb19
- MD5 22f44d5d7b693dc67a5de9ac5041ca63
- SHA1 5275a92d8365e8c9c4a1718f3413f78a9a82ac80
- SHA512 3ea78965c53469652fa869e60fbdc09d468b0b22c2546516498c915d4674b11da81dc9fb77c437f629dd1fdbb390d4030b72d741feb24f972a1111225dc5de00
- SSDEEP 49152:j/S58dcaq458qhScpwR6KiZtGSz5XzwwyRQiPDU0oT:j/yicaqDup66KsVXsd1oT
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral11 behavioral12
- Target
  TCLSCOPY/TenProtect/TP/TPHelper.Installer.exe
- Size 9.7MB
- SHA256 6db8e3776e594dbbffbac641b6cb0cb8cbd256ffeef890f8d41165832d06f21e
- MD5 1e58366794fd45f46e7045c24b8a9057
- SHA1 596ec948e37a1194de0294b3bcb66f597454dc31
- SHA512 2d2acc2492796e8ff8c2595aff9e5f23e50f3834d1615ca9ebc09d69f0d74b966c82ac90c339077d4161cf05b848ede1d70066b85e9c98434eb815c3414838f1
- SSDEEP 196608:0Dy14Aze/q47XS3WFnxNUivZ67VZyfgf/ZuiEMUSinQtp:0O14A74NOivZ6+fgbEUinQD
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral13 behavioral14
- Target
  $PLUGINSDIR/System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral15 behavioral16
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- MD5 c10e04dd4ad4277d5adc951bb331c777
- SHA1 b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA512 853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP 96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral17 behavioral18
- Target
  $PLUGINSDIR/nsProcess.dll
- Size 4KB
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/nsUnzip.dll
- Size 146KB
- SHA256 4e4e429ecf1c49119a21c817899f64152b03b41b036fc1d92aee335043364c43
- MD5 77a26c23948070dc012bba65e7f390aa
- SHA1 7e112775770f9b3b24e2a238b5f7c66f8802e5d8
- SHA512 2e7ffa4ed5c97f555e1b0d6f55ffcfd53cd28302fc77d95fdaea89e0b6b42e67e366331e52358e78e8266d079cc2ca3ea4c909197fb38a5b4c8151c7678d0065
- SSDEEP 3072:3imoHcJg67rm+2X7jiYwJAmcxaw2VvnCNizd9XER4I6CAZJPtAY3:3I8Jlrm7SnjCNizdhER4I3kP3
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral21 behavioral22
- Target
  TPHelper.exe
- Size 1.8MB
- SHA256 81c5b055bece2b600dd68bd830e38feafa29be63b3dc1c76551267d949166cfd
- MD5 a300794c743e95898ff903223db6e01f
- SHA1 17e82069e276eba775f764b6fca249abd952db51
- SHA512 681deaf978918e6d97129ff1d7939b9bfc35d491d332c34fc77f43a2e0b40b5bf9d3e013430137720237120959f0d56d7be60b77c2ccf2f1178ddc07a8a3b53e
- SSDEEP 24576:0rdK8AU6l8SKcExMqLL+6h6CxTcY8oZZ+ujYZqt5gG+a:0By1KwW2YRY5KZ+a
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
behavioral23 behavioral24
- Target
  TPHelperBase.dll
- Size 13.7MB
- SHA256 834b6f2523c339bb4802ccb44a03cd389981a8d563637fe40427f26ed8dd785a
- MD5 dc6b801a2c9fb7887afa7a01977b4ab8
- SHA1 3e88ab216730d38c582472026364a6e5209989d4
- SHA512 04030c85f93effe24f4577377b3131455e3a04d72f77cfede6e0fbabe9d04fcd3dbc4feba77eba1f8211edf6d7d3dcb9a16f10930d5bbf84d2b82fe199299e94
- SSDEEP 196608:UHglfhh50TyRV/ky8oUyVcFwKsLpv9i+WlS:UH6QTyRV/kLo3GFiVWlS
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral25 behavioral26
- Target
  TPWeb.exe
- Size 653KB
- SHA256 b0d8b44c718a1bd5ad76f908267e6719182029ac133e013d4e2bfa9649fa3a85
- MD5 7ababcbe2cdfd5cb2125cb4d65e240e2
- SHA1 9c5a97f82aca40fec2216467306bd480792704ab
- SHA512 95ad8549b1e8ec90a30b06f0ceac02ab55625d380ff5ec94561fd70904b310c1c14f210f1fd9c37915135671f0c5ce3924a56972ec613f7f0e61d02bb4a63ea4
- SSDEEP 12288:OBWvpy+dHHlFmmM38L29wm+qa4kfmBRMFJ1tY5rC6L2wOUPNU/biqTBxcpamfnZs:OBKM38S97oIRSECxTcFZiz
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral27 behavioral28
- Target
  BugTrace.dll
- Size 1023KB
- SHA256 395bddd46457f0a7dc0d9ff0969dc6d5a85a3d97bf17c79acecc61b3f9ec0ca9
- MD5 78e380a399e72fd196f4a5729d0fc08b
- SHA1 03fa0f0c27b342184c64ca2ba18e52b369248d64
- SHA512 4bf3dc9eb71ab3cdae0fe522768f2ac6a61db1566a9967d3aa7a5c602bc762fbeccc9040a5ba0a9990328db13c9e202020c2457b08be210117d2de3a7ff4f106
- SSDEEP 24576:ptxxS2nDFt5FW/MJy/Kvpzk4yN++uM3fgQAfz3vfP/G:1XO/UtBzk4yN5nPgQAfz3vfP/G
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral29 behavioral30
- Target
  Tenio/June.dll
- Size 842KB
- SHA256 79987a7c9ee35d6d06a493ffc25b57e68faf813fcbf85dab37f5a793df5ce149
- MD5 5eb113f738e9c38dfafb24264c79b9e8
- SHA1 eb7328370f436f6962281dc627b487384ce0364a
- SHA512 63596d2457be2ce81e89a1fd94d81d290a68f2cdf87904f567691dcd96b7d7e45b4b32a39857d4ec1e851182cadab71804538fdd356b16e9fde85e5711d1b95c
- SSDEEP 24576:xka69uMlhRpJT0wbl4lFVunw0ToZIcj8TBi+:B83JoFVAToZCT5
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Writes to the Master Boot Record (MBR)

Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32