7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f

Sharing

Copy URL Twitter E-mail

General

Target
ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118
Size 194KB
Sample240409-s2zclaee3t
SHA256 7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f
MD5 ea531aaff6bd48a85fd2487979af5d6b
SHA1 d9f39bbdbbfbcf0f2b677d142adde921b42861ce
SHA512 b622d4258c96ea855cb7773d0d703c74836a1223fce85f7711acb898e5cd67bb0c912c31cc65496c949bb8d5680905529fb458de2d67e9da2ab540f1c1caff8e
SSDEEP 6144:HwRidvldbA6T+Xn8cTAGFD5tfQoF9pACA6A5Jgqsms:M2ldbQXzdrfQa8Cbggqe
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  ea531aaff6bd48a85fd2487979af5d6b_JaffaCakes118
- Size 194KB
- SHA256 7bfa96ea7e2f70c3fdee3ce490a283b82a02e8e2f4ca724fc98cf70f90d8b92f
- MD5 ea531aaff6bd48a85fd2487979af5d6b
- SHA1 d9f39bbdbbfbcf0f2b677d142adde921b42861ce
- SHA512 b622d4258c96ea855cb7773d0d703c74836a1223fce85f7711acb898e5cd67bb0c912c31cc65496c949bb8d5680905529fb458de2d67e9da2ab540f1c1caff8e
- SSDEEP 6144:HwRidvldbA6T+Xn8cTAGFD5tfQoF9pACA6A5Jgqsms:M2ldbQXzdrfQa8Cbggqe
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

adware discovery persistence stealer
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
- Drops file in System32 directory
behavioral1 behavioral2
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
- MD5 7e3c808299aa2c405dffa864471ddb7f
- SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
- SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
- SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral3 behavioral4
- Target
  $SYSDIR/$SYSDIR/$_14_.exe
- Size 46KB
- SHA256 0edcfc77ab368f894127d802e26d27f7cc1eb275c7e9f18fea4e6ee748abccf4
- MD5 394b247ea0586e4e8b52f3bd4e283504
- SHA1 885d12398788a06b028ce98272b89bbb0f14dd81
- SHA512 b751e26ac21545934e4a4479d6d1a80a740dc7af7daebe176399155a2cf1b8ee62bea0ca400cee635f0ebb92c5f0c0ecaafd7bfe85ac20812ea155b45dfc7000
- SSDEEP 768:SSup23EQCjlQRB8/ewZ1iU6nyYFxbssT/F/O71mJ5TJRn0OSk3thG9bvLAoTlBBb:Hu4EQalMK/ewGnh0mJ6+3vobDAuTKe
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10
- Executes dropped EXE
- Loads dropped DLL
behavioral5 behavioral6
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 2ca5590c85cc31285b83bbe569755d909d91b559db2d6ce3bca2fcc075225364
- MD5 06bef96b91bfa75b7f7817341a6cd597
- SHA1 48a40368fc339ccea1dfda06d2e02bca7d7265c1
- SHA512 5364d0944b4be215fb5d8bb8398e965ff6fa3190a962dd6c491984482321756017f89c2242d77ebcce6666c31fe54a956f2eb3a03a95d64121a1db462ad20a0d
- SSDEEP 192:Q6JaVGQ+xI5EeuyvMmGpeWH2J5xprN+AxTtK72dwF7dBdcQOz:Q6JaVh4I5rpPbTt+BdhO
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 91c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
- MD5 7e3c808299aa2c405dffa864471ddb7f
- SHA1 b5de7804dd35ed7afd0c3b59d866f1a0749495e0
- SHA512 599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
- SSDEEP 192:LO6dJA/ruAFEiUdWWE6hsD4YUdJfbub1awgMO:SKAFERdlxhTYUzqZaw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $TEMP/$_8_.dll
- Size 381KB
- SHA256 13e04a3fc70b4215feb1c4d01d74a1084d2248caa6196ff4ba91d196095c90c1
- MD5 b194d282bb6b81ecfdea7a44f9cd0d8d
- SHA1 372fa3b4f01fe7979472db8ba59e2ece7053fdb8
- SHA512 1fd0ce9bb35e0a9b28be04d86120cf87f9de436835b0f98409dde5e1dd104ca575fc3da5744209cbadf0be75451571241ead5d1e79e2daf2a43b4a2163e57062
- SSDEEP 6144:rgxECaD3NFLzhrvhayIvR+z8SndYFN1y2antUIYucX5ZLKI4j:rgxxaDn3hrpayIvR+A+dYFN1y2aCIYug
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10

adware persistence stealer
- Adds Run key to start application
  persistence
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral11 behavioral12

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Installs/modifies Browser Helper Object

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Installs/modifies Browser Helper Object

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12