9a1fbf837e9e350ac567457bdaa0ada6cd3aeb441433a298f4d2aea51b359842

Sharing

Copy URL Twitter E-mail

General

Target

0e6079dcf87edebc2a028d67f2c5a402_JaffaCakes118
Size

3.9MB
Sample

240502-nnh18saa77
MD5

0e6079dcf87edebc2a028d67f2c5a402
SHA1

ea34977ee7c179c940fd03dfe8dde3b0a3228e7f
SHA256

9a1fbf837e9e350ac567457bdaa0ada6cd3aeb441433a298f4d2aea51b359842
SHA512

b6f74633275a472f2c1ad67be1d70ee53bd191396bbb0750d1be76689a14d578656796b58fb4461c3bdd520fe2a2bae83df79546452b5cdd0751c3d0c05b9687
SSDEEP

98304:tMIyKylS0ljlG62wIqmNodd9MpD9b0gZNWTr7fjUpw91Jc:CD3dvGwmNoddisiWTrDjUU1u

Score

7^/10

bootkit persistence

Malware Config

Targets

- Target
  
  0e6079dcf87edebc2a028d67f2c5a402_JaffaCakes118
- Size
  
  3.9MB
- MD5
  
  0e6079dcf87edebc2a028d67f2c5a402
- SHA1
  
  ea34977ee7c179c940fd03dfe8dde3b0a3228e7f
- SHA256
  
  9a1fbf837e9e350ac567457bdaa0ada6cd3aeb441433a298f4d2aea51b359842
- SHA512
  
  b6f74633275a472f2c1ad67be1d70ee53bd191396bbb0750d1be76689a14d578656796b58fb4461c3bdd520fe2a2bae83df79546452b5cdd0751c3d0c05b9687
- SSDEEP
  
  98304:tMIyKylS0ljlG62wIqmNodd9MpD9b0gZNWTr7fjUpw91Jc:CD3dvGwmNoddisiWTrDjUU1u
Score

7^/10
- Loads dropped DLL
behavioral1 behavioral2
- Target
  
  $PLUGINSDIR/FindProcDLL.dll
- Size
  
  3KB
- MD5
  
  8614c450637267afacad1645e23ba24a
- SHA1
  
  e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA256
  
  0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- SHA512
  
  af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
Score

3^/10
behavioral3 behavioral4
- Target
  
  $PLUGINSDIR/KillProcDLL.dll
- Size
  
  4KB
- MD5
  
  99f345cf51b6c3c317d20a81acb11012
- SHA1
  
  b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA256
  
  c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- SHA512
  
  937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
Score

3^/10
behavioral5 behavioral6
- Target
  
  $PLUGINSDIR/License.rtf
- Size
  
  79KB
- MD5
  
  6b49cb824fc11edb01d0ee4dee1bd54a
- SHA1
  
  81291caac7aaad7a439b5f8564ca26b320732b03
- SHA256
  
  7d13c20e98677d3434ee1610b8f29d6b78b71026840d9434a298d8680ca649a6
- SHA512
  
  b06a655b590e5a201a394d7f982c02c515a741653f81cb28bbca5a20097e16f2f09a81aee1648a7b725cc584f04a77825e0c5b1b5bee578ca6a21ab0f4934a19
- SSDEEP
  
  768:iNt4l3sjvUxnJ4mbjWn9G6GXBKgGYUWwlC1xVbn:ngrQJn
Score

4^/10
behavioral7 behavioral8
- Target
  
  $PLUGINSDIR/SkinBtn.dll
- Size
  
  4KB
- MD5
  
  e4ec95271ff1bcebab49bdfed6817a22
- SHA1
  
  2c03e97f4773aea80ecdb98a1482e5896fe4677b
- SHA256
  
  ee1c06692a757473737b0ebdef16f77b63afac864d0890022d905e4873737dd6
- SHA512
  
  771a527133806307a1b17b7e956d6a3c16e9bc675bf084b43204ae784a057dac2726dbf90645692876043a4e7365ba8825c167621fde4760c79cd84679e2aa3d
- SSDEEP
  
  48:iIf3aEDfeWm8JHFQbUrUPJJDFoetaxn/pFW3GNivz187eqzI/kMr8oX0Zbj:lv9Dfw8DQbhD2iaxn/PHmiNI/dQFZH
Score

3^/10
behavioral10 behavioral9
- Target
  
  $PLUGINSDIR/SkinProgress.dll
- Size
  
  4KB
- MD5
  
  cc037c4703d3ec257efeef2ce0a1a20e
- SHA1
  
  b3d6cc8f687a31fb2c1a5921a38de9429af20502
- SHA256
  
  888b32ecbc37ce67d4edc28d894cba0a4f4e2488cfc2212d1af011bd0bfe97ff
- SHA512
  
  120bfa0a68775bef04c1863023b0e73a41982284fb36da7f497fbb7d5ed8631ad02fa09951424d339f6fefaa90a17c12f949dd68bb33bad64b1b7cace489d2a7
Score

3^/10
behavioral11 behavioral12
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  11KB
- MD5
  
  c17103ae9072a06da581dec998343fc1
- SHA1
  
  b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA256
  
  dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- SHA512
  
  d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP
  
  192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
Score

3^/10
behavioral13 behavioral14
- Target
  
  $PLUGINSDIR/WndProc.dll
- Size
  
  3KB
- MD5
  
  f0cb331dd4bd92a6ebce45e7cd1cf5ef
- SHA1
  
  b66ea0c10b08750295f2dc7c170b370402393214
- SHA256
  
  e7b3115fa2ce4a8fa09beeefa4fb634a474197f38a2854ce9be60d0a26016458
- SHA512
  
  7c33418f39b91ae0d4cc8b560f516bac293593eef539832815028878c2058bf1691c2d767a039cf312989839071f2f6f0b6d9d59835acdfff6b448bf1ffea271
Score

3^/10
behavioral15 behavioral16
- Target
  
  $PLUGINSDIR/nsDialogs.dll
- Size
  
  9KB
- MD5
  
  c10e04dd4ad4277d5adc951bb331c777
- SHA1
  
  b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
- SHA256
  
  e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
- SHA512
  
  853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e
- SSDEEP
  
  96:hBABCcnl5TKhkfLxSslykcxM2DjDf3GE+Xv8Xav+Yx4VndY7ndS27gA:h6n+0SAfRE+/8ZYxMdqn420
Score

3^/10
behavioral17 behavioral18
- Target
  
  $_47_/Web/error.html
- Size
  
  2KB
- MD5
  
  9085af5c4c8fc9fc7c83ff132daf4970
- SHA1
  
  b91dc15b71fb30e923761b89c6a9ef85635bcf2d
- SHA256
  
  7dce7e40633ab511ea62e62943c71981e5e91eeb21ca98a1bcf5338bd3ceb3b3
- SHA512
  
  8465e6d1c5cca1e690b4c3889ffee61d2816c6fe04771fab75c9a463f73cf9bb2ae3e0b47aff9b9e30173b2d25d52bb9c4ccaf9d380bcf5d78a6e039e873722c
Score

1^/10
behavioral19 behavioral20
- Target
  
  Accelerator.dll
- Size
  
  306KB
- MD5
  
  eeaea8bccc2b1b0ac05f854986c40e17
- SHA1
  
  499013f38a367a09dc749ea67b86016825905243
- SHA256
  
  6dd5e176f5615cf498a7c7be6d5ea76acfdb7e09645f6362381db40f9fc5cd8d
- SHA512
  
  a9267dceba0b060ec8662b2b9f3756eae2b7d45bf97cef7bf922e2990ba30e156944a27595356fe456f19a6eaebf0a7c115926b5d6ebff085a403e4ae8b19268
- SSDEEP
  
  6144:E2GMn+qaIrAf4pd3DecSGUHmJYSJuXEj0j888888888888W88888888888S:X3+yt8SYiuc0j888888888888W88888K
Score

1^/10
behavioral21 behavioral22
- Target
  
  Basicsurvey.exe
- Size
  
  657KB
- MD5
  
  3d97a00f1050c2c33208ddc59d022f2b
- SHA1
  
  f272b2b253c176d4a5c564acb0723a684f7759c2
- SHA256
  
  71a77d9aac36dac25973056936e160d64528a285f805a9d354b40d57934d5ff4
- SHA512
  
  7e044bda6aa6f80e65410135a0d3320f291e59baf8c187488593581cb6e3c584d95215221f5298488a1a157dfa72ee3c83fda0cfdbcf9b5de7ca10b3137b1bfe
- SSDEEP
  
  12288:gjJYOQrD9xKJX7evc1lL+OeO+OeNhBBhhBBH2DC6OoB9kSxLRE3Qn4TtQGGHdjQ:gj2Oc9xKJX7eClnC6NBJxLReQnzJdjQ
Score

1^/10
behavioral23 behavioral24
- Target
  
  MouseHook.dll
- Size
  
  31KB
- MD5
  
  45beec8b9ebae038db40b44aed1f5114
- SHA1
  
  276df4db6ed355d01d57e942809412a31173ca5a
- SHA256
  
  e92b64cdc5fdb6015c0227166d7bba1e62da2d9ccad95128f104d0f391478fba
- SHA512
  
  d06793aa9cdb6fe883d8cc10b74c094eb344d82d089c0888d848d406227559533628d6c11b68d943added8218f4eb1bdde9d4e57f596d3f439461e2c690d6046
- SSDEEP
  
  768:vHr98zW8XvCBcaxP1pGai292OKZojnuerT:vL98zW8fCWa1x2OKZoFT
Score

1^/10
behavioral25 behavioral26
- Target
  
  Socks.dll
- Size
  
  962KB
- MD5
  
  7446d6082ac880ba3bf04415b691008c
- SHA1
  
  25460afb5ce8f51fcf6fd313cc9ac2a3c2f5b45d
- SHA256
  
  ecb60e67dd4161165c7015bb66352384e74ef0b96fbe31d3d87fdec21dd275f7
- SHA512
  
  e1e4af966374a719e24c92212e0992ad8c990bde520d82380baf2ff7d3c4d8518b216d14e4fea048f2af748d856e8a6cfc961560ee2e4eae07b25ba570aae5df
- SSDEEP
  
  12288:rOVW7eBdym2J0MuHEysIk8zTFHFI+OeO+OeNhBBhhBBowQAbkLOD1+N5/KUKrvVk:r+1kFInzTtFewrkOD1+5SUKrvwd4W
Score

1^/10
behavioral27 behavioral28
- Target
  
  gamebox.exe
- Size
  
  2.7MB
- MD5
  
  c484e7102a2fbc0ef12a8f02e9de6bc2
- SHA1
  
  f1924a7d87767d71964ed65a3d87f29b3c272376
- SHA256
  
  fb56fc7902e5314005cfb659ead3181c7b67df89329c0b2aba1a6fbb389fdbe5
- SHA512
  
  2aecf399657e2ae6e75668f8d8941bb9a76aa614b5d598e089e2b5be8ae53ddd3199fe2ac8102f063ca301ae40d3fd83e9d0c7894766fa56e25a5b947d88d831
- SSDEEP
  
  49152:FLeHgFhQXB8952lCLDH613iXb54oCJxsjg1OE2tHT5dKgXH+qPFpIijCcdIm:NeShW8952lCLDH64Xbed/sjgJiXH+S
Score

6^/10

bootkit persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral29 behavioral30
- Target
  
  tabGame.exe
- Size
  
  1.2MB
- MD5
  
  2da4858b1eac678f9537a756c5843268
- SHA1
  
  11c5b776e7d0ac9f0c17cab9e5da015987c79a96
- SHA256
  
  fcff4ec608b8b57d65170fe8112b4f3e8df27507b7c951639feb56329b9faee4
- SHA512
  
  5cf789342ebe849fe91ac13403d008754c3135c1ee31e23e73310ed8db2d9ce75e0ad515ff428dace7fcfe3711f0b4f1713433aef2e0a0ba839756a98c4436a7
- SSDEEP
  
  24576:SRma19NRTXCOISrFG8TR3e1JA1KxkXH+hMuf:UL19NwOFGu3km1KxkXH+hMuf
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32