Overview

overview

7

Static

static

3

e355481093...18.exe

windows7-x64

7

e355481093...18.exe

windows10-2004-x64

7

$PLUGINSDI...ig.dll

windows7-x64

3

$PLUGINSDI...ig.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDIR/UAC.dll

windows7-x64

3

$PLUGINSDIR/UAC.dll

windows10-2004-x64

3

$PLUGINSDI...ss.dll

windows7-x64

3

$PLUGINSDI...ss.dll

windows10-2004-x64

3

IETab.dll

windows7-x64

6

IETab.dll

windows10-2004-x64

6

IETab.exe

windows7-x64

6

IETab.exe

windows10-2004-x64

6

IETabHelper.dll

windows7-x64

1

IETabHelper.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    e3554810937d8b4439be8a247dcad002_JaffaCakes118
  • Size 330KB
  • Sample240406-1d2rtabe7y
  • SHA256 5f0eb604489fccc60a72467d3dc77a2d8bf20af82935d425f2a470fd6cb7f014
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverypersistencestealer

Malware Config

Targets

    • Target
      e3554810937d8b4439be8a247dcad002_JaffaCakes118
    • Size 330KB
    • SHA256 5f0eb604489fccc60a72467d3dc77a2d8bf20af82935d425f2a470fd6cb7f014
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    discoverypersistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2
    • Target
      $PLUGINSDIR/IpConfig.dll
    • Size 114KB
    • SHA256 ec0f85f8a9d6b77081ba0103f967ef6705b547bf27bcd866d77ac909d21a1e08
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral3behavioral4
    • Target
      $PLUGINSDIR/NSISdl.dll
    • Size 14KB
    • SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral5behavioral6
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 13KB
    • SHA256 a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    behavioral7behavioral8
    • Target
      $PLUGINSDIR/nsProcess.dll
    • Size 4KB
    • SHA256 95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89
    • MD5 SHA1 SHA512
    Score
    3/10
    behavioral10behavioral9
    • Target
      IETab.dll
    • Size 182KB
    • SHA256 f8e32b4fc84d1898c1a55640640c77024370525bd85cc3b0f51d3d24a55f847c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    adwarestealer

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral11behavioral12
    • Target
      IETab.exe
    • Size 126KB
    • SHA256 e99d960ce333b2d0d8675b9eddf788f1c5d9b630afa38c12566ffbd067c5d1cc
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    adwarepersistencestealer

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware
    behavioral13behavioral14
    • Target
      IETabHelper.dll
    • Size 34KB
    • SHA256 7873b2030ffbca9c48ecbf6c573b4269f33a6a0226cfbad09e520000ed6a7956
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Tasks