b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce

Sharing

Copy URL Twitter E-mail

General

Target
264b27b9ac7ac6874e50d073638930b5_JaffaCakes118
Size 1.7MB
Sample240508-xtnncaae6s
SHA256 b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce
MD5 264b27b9ac7ac6874e50d073638930b5
SHA1 4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265
SHA512 8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d
SSDEEP 49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Targets

- Target
  264b27b9ac7ac6874e50d073638930b5_JaffaCakes118
- Size 1.7MB
- SHA256 b5476446d4f5ac386bdd94987323ed71f70de54016ba19ce31e6e46b43e267ce
- MD5 264b27b9ac7ac6874e50d073638930b5
- SHA1 4e2b68ab76ea8afaa6ef03dde72ab1ad5fd1f265
- SHA512 8f78943b1526f29c26f8f34571eb40b0fa9396d02876e76a7c6311340f0a7ee2826890a1cfb5f0aa0077d2726ef1458b16de33cdc55706df09a8ee95bdd9702d
- SSDEEP 49152:kO0e40QOdfZ7B1OHZYlLjqyJkUs75Naw4O5:kO0Z0QIfH1SM/qkkVbd4O5
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit discovery persistence
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1 behavioral2
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
Score

3^/10
behavioral3 behavioral4
- Target
  $PLUGINSDIR/InstallOptions.dll
- Size 14KB
- SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
- MD5 d753362649aecd60ff434adf171a4e7f
- SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
- SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
- SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral5 behavioral6
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
Score

3^/10
behavioral7 behavioral8
- Target
  $PLUGINSDIR/StdUtils.dll
- Size 94KB
- SHA256 2aaef1ed8a25097b3a807568daeffd3320fa29d6de66df90a57beaa8df8949cf
- MD5 0061a96c8ff17ad0927aae65b5dfe06b
- SHA1 9d1bd69d930ccda683e6b7c2c0d1dbe3b54861fe
- SHA512 c6b887a4e1682ba1e126c93bc4d886c7f1ce392f97866e631c5b8a945824cbefc9af2429a14c2dac3b16d97bd33195d4378a7e92ae53fdeb47197452d4d90fc4
- SSDEEP 1536:0yy+i55jAPWrI5qXgcAZ5c4DB5G7NXE9eOO2xwN:3y+i5i+kEQcAZXGx0cr2xw
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral10 behavioral9
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral11 behavioral12
- Target
  pluginsetupadmin.exe
- Size 461KB
- SHA256 c007fefe59aa783e7ea677a6275f87b9675f750a8e31a67c8325440308eed90a
- MD5 87daf3658c6aa863444532f1f324cca1
- SHA1 c0caa342fcbde6a0c6b1566e71bc051117a7c40b
- SHA512 050b10619e355fe16fc23bf83b7b38a5237adb80e406d79653c029182bf33a40c3717a12f80ce1e024e2afee305421b3f3947d38a833169576e1c3d0a9ebc551
- SSDEEP 12288:7ugClTRuCj6KxXpDKlvuONobWHp9d/MJyKRs:78TRuo6KxZeluooKh/SyKRs
- MD5 SHA1 SHA512 SSDEEP
Score

4^/10

persistence
behavioral13 behavioral14
- Target
  sz.exe
- Size 1.2MB
- SHA256 bcc516b915a8826ef12689e455d0b1afaa7ad1eae534729eb43e6639a95992f6
- MD5 5fd84590e2e1358a8e51fb76b1b3d721
- SHA1 eea0902b66e1082a5ba9a1ad7c4bcd3fb5d53154
- SHA512 3e9de52d11522b5115d30b51a6cf5b43e28df27432e7d0aa0eeecd0648ab1d3622b30f921bbed011681ba7c286d71053486bb0b6949103b69adab1cc4e5e1281
- SSDEEP 24576:hyPL2BkBGuDHCu9lpaE6ua0gY28UlyvCKk3U9wlozxjv2k6DjIVnF0SK+OGkn:G2BkBpCurMpujW8ptxOkMj6nFjdO5n
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral15 behavioral16
- Target
  uninst.exe
- Size 400KB
- SHA256 1cb9f1b81e6c5b98feddee92c9d14fff89d4b111b0c0974c6e804d7dfdc36bdb
- MD5 7ded51e887171a321fd7f5f59925ea42
- SHA1 2d2654c5e0c4fb557383842a7de1c2036a2f569c
- SHA512 980489325baa4c17d727334076e4228d582afe0884548bc132f4991cca6e96a92605c9b777af0b62162f90a326ee1145d2dcb056fc30390b28d6c9f015138827
- SSDEEP 6144:H8LxBH3+tUVHZfKfj+v9ETgRPOILnMLPAiaINBIs/IYlAJA3Tfk6:M+tUT7OKMLPTaINBIs/nAW3Q6
- MD5 SHA1 SHA512 SSDEEP
Score

7^/10

bootkit persistence
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral17 behavioral18
- Target
  $PLUGINSDIR/FindProcDLL.dll
- Size 3KB
- SHA256 0fa04f06a6de18d316832086891e9c23ae606d7784d5d5676385839b21ca2758
- MD5 8614c450637267afacad1645e23ba24a
- SHA1 e7b7b09b5bbc13e910aa36316d9cc5fc5d4dcdc2
- SHA512 af46cd679097584ff9a1d894a729b6397f4b3af17dff3e6f07bef257bc7e48ffa341d82daf298616cd5df1450fc5ab7435cacb70f27302b6db193f01a9f8391b
- MD5 SHA1 SHA512
Score

3^/10
behavioral19 behavioral20
- Target
  $PLUGINSDIR/KillProcDLL.dll
- Size 4KB
- SHA256 c2689ba1f66066afce85ca6457ecd36370be0fe351c58422e45efd0948655c93
- MD5 99f345cf51b6c3c317d20a81acb11012
- SHA1 b3d0355f527c536ea14a8ff51741c8739d66f727
- SHA512 937aa75be84a74f2be3b54dc80fac02c17dad1915d924ef82ab354d2a49bc773ee6d801203c52686113783a7c7ea0e8ed8e673ba696d6d3212f7006e291ed2ef
- MD5 SHA1 SHA512
Score

3^/10
behavioral21 behavioral22
- Target
  $PLUGINSDIR/System.dll
- Size 10KB
- SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
- MD5 56a321bd011112ec5d8a32b2f6fd3231
- SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
- SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
- SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral23 behavioral24
- Target
  $PLUGINSDIR/inetc.dll
- Size 20KB
- SHA256 6d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
- MD5 50fdadda3e993688401f6f1108fabdb4
- SHA1 04a9ae55d0fb726be49809582cea41d75bf22a9a
- SHA512 e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
- SSDEEP 384:jQB2ZUVHUxgoJX0eBA6PcH85db+ya9cC0Ac9khYLMkIX0+G5xgZmT+m//a:j/UFeJ5S6PHLNa9cFam/
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral25 behavioral26
- Target
  $PLUGINSDIR/nsDialogs.dll
- Size 9KB
- SHA256 4cd17f660560934a001fc8e6fdcea50383b78ca129fb236623a9666fcbd13061
- MD5 f832e4279c8ff9029b94027803e10e1b
- SHA1 134ff09f9c70999da35e73f57b70522dc817e681
- SHA512 bf92b61aa267e3935f0ea7f47d8d96f09f016e648c2a7e7dcd5ecc47da864e824c592098c1e39526b643bd126c5c99d68a7040411a4cf68857df629f24d4107d
- SSDEEP 96:ytJ6tC4jcY5rKhkfL9SYdKkcxM2DjDf3GEfKvBKav+Yx4yndY7ndS27gA:yyj6QS8HREf+BYYxbdqn420
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10
behavioral27 behavioral28

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Executes dropped EXE

Loads dropped DLL

Registers COM server for autorun

Checks installed software on the system

Writes to the Master Boot Record (MBR)

Deletes itself

Executes dropped EXE

Loads dropped DLL

Writes to the Master Boot Record (MBR)

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28